Does HSTS includeSubdomains also include other ports on the subdomains?

Question

Context

I have a web application (SPA) that uses a http api at a subdomain and also a websocket server on a different port of the api domain. Example:

• https://example.com/ the web application
• https://api.example.com/ the http api
• wss://api.example.com:6001/ the websocket server

The Web application and the api are served via a common web server (Apache) and they are configured to send a HSTS header like this:

Strict-Transport-Security: max-age=31536000; includeSubdomains;

Hypothesis / Research

I tried to search online and skim the spec. Especially (with my emphasis)

5.4. User Agent HSTS Policy Enforcement

When establishing an HTTP connection to a given host, however instigated, the UA examines its cache of Known HSTS Hosts to see if there are any with domain names that are superdomains of the given host's domain name. If any are found, and of those if any have the includeSubDomains directive asserted, then HSTS Policy applies to the given host. Otherwise, HSTS Policy applies to the given host only if the given host is itself known to the UA as an HSTS Host. See Section 8.3 ("URI Loading and Port Mapping") for details.

I now assume that the HSTS header from example.com:443 should already force the browser to use TLS for any connection to api.example.com:443 and also api.example.com:6001. Because it will only look at the domain name and not at the ports.

Questions

Am I reading the RFC correctly?

1. Does a HSTS header send for one domain cover all ports on that domain?
2. Does a HSTS header with includeSubdomains cover all ports on all subdomains?

Answer 1

The HSTS header informs the client, that the host/domain or domain with subdomains should only be accessed using HTTPS (which is a secure transfer protocol), and that future attempts to access it using HTTP (which is a unsecure transfer protocol) should automatically be converted to HTTPS. Since this is protocol related, the port does not matter at all.