I am trying to understand the includeSubDomains directive in the HTTP Strict Transport Security standard. In particular section 14.4 of RFC 6797 confuse me.
Point 2. says
The HTTP request sent to uxdhbpahpdsf.example.com will include the Secure-flagged domain cookie.
This seems to imply that if a domain cookie has been set as secure, it may in fact be transmitted to a server before the certificate of that server has been validated. That would completely defeat the purpose of setting the cookie to be secure in the first place. If that's not the case, then what am I misunderstanding in that paragraph?
Point 3. says
and the user "clicks through" any warning that might be presented
This seems to imply that the threat scenario would only apply in case the user ignores security warnings or a CA signed a forged certificate. But if either of those were the case, the attack could just as well have been targeted at the example.com domain.
What is the connection between includeSubDomains and that paragraph? Point 3. only deals with a scenario, where the communication is passed over HTTPS anyway, which means HSTS wouldn't make any difference.