I am looking up the behavior of HSTS on both HTTP and HTTPS websites, and their HTTP and HTTPS embedded resources. My understanding is that if an HSTS response header has been passed on by the server in an HTTPS response, or if the site's name is present on the HSTS preload list, then all the resources of that request would be sent on HTTPS.
However, while inspecting some sites via the Firefox Web Inspector, I am noticing some discrepancies. For example, here on
cnn.com (an HTTP website), some of the requests of
doubleclick.net's subdomains are going over HTTP, even though it is present in the HSTS preload list over here (with include_subdomains:true).
Just to test whether the root domain was sending the HSTS header, I navigated to the
ad.doubleclick.net link in the location address bar which directed me to Double Click's main site
https://www.doubleclickbygoogle.com Over here the HSTS header is being sent:
Yet, there is no effect on
doubleclick's requests on
cnn.com when I reload:
Another interesting thing is that when I try to locate the source tag of request on the DOM by going to the Inspector tab, there is no such tag with
http://ad.doubleclick.net (strung with some querystrings). The "Cause" and "Type" heading in the inspector seem to indicate its some tracker sort of a pixel.
Does anyone have any idea what could be going on over here?