Re: [whatwg/fetch] Double-keyed HSTS (#920)

Thanks John! Does that mean that if 1.2.EXAMPLE requests 2.EXAMPLE in a subresource the latter is allowed to set HSTS because it's same-site with the former and therefore still first party and also the first party registrable domain? And the former is allowed to set HSTS because it's the exact domain? But a subresource 0.1.2.EXAMPLE would not be allowed to set HSTS even though it's same-site?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/920#issuecomment-522581234