Section 7.2 of RFC 6797 states:
An HSTS Host MUST NOT include the STS header field in HTTP responses
conveyed over non-secure transport.
In practice, I have a lot of hosts that are behind an Amazon load balancer that where requests from ports 443 and 80 are forwarded to the same Nginx configuration. It would be considerably simpler to always send the Strict-Transport-Security
header, regardless of the incoming protocol used.
I don't care if the UA ignores the header on insecure requests. I'd just to like to confirm if this RFC violation causes a problem in practice.
Insecure requests are already redirected to secure versions by the server, where the UA would then receive a valid Secure-Transport-Security
header in their response.