I recently audited a website with three hosts: the main site (example.com), and two subdomains (let's call them portal.example.com, and welcome.example.com).
According to the response headers, HSTS is properly set for each host:
strict-transport-security: max-age=2592000; includeSubDomains
When loading the hosts into Burp, I was unable to create a security exception in Firefox to accept Burp's self-signed SSL cert to proxy HTTPS traffic (as expected). Both of the subdomains, however, let me create a security exception in Firefox with no issues. Additionally, this allowed me to bypass the HSTS on the main site, since once a security exception had been created for either of the subdomains I was able to proxy HTTPS traffic for example.com with no issues.
What am I missing? I thought HSTS would prohibit this activity, especially if it is set to includeSubDomains
.