The result shows:
Strict-Transport-Security max-age=31536000; includeSubDomains
However, our client comes back saying it is still not the case. They told us while our main URL is HSTS enabled, the test vector URL is not.
- Go to https://gf.dev/hsts-test
- Put in https://nvisium.com and click Test Header
- Result shows it is HSTS enabled.
- Do the test again but put in https://nvisium.com/test.xml (test.xml does not exist)
- Result shows it is not HSTS enabled.
If I put the URL to an existed resource that it passes the HSTS test.
My question is do they have a point? or is this a false positive test in one of the Penetration test software they use?
Playing devil's advocate, I can only argue that if you request a non-existence resource, the web site still sends a response back and that it does not force the client to use hsts.