Misleading results for subdomains and preloaded TLDs
ericlaw1979 opened this issue · 6 comments
Repro:
- Visit hstspreload.org
- Enter blog.google and hit Enter
Expect:
This domain is preloaded
Actual:
Claims it's not preloaded.
This was recently fixed in the HSTSPreload API, but that change doesn't impact the website. Discussion of this limitation is here: chromium/hstspreload#102 (comment)
The same issue can be seen if you query a subdomain of a preloaded eTLD+1, e.g. Status: www.bayden.com is not preloaded. despite the fact that "bayden.com" is preloaded.
As a hacky workaround, I suppose we could just issue more queries; dropping one leading TLD label each time.
The change to hstspreload didn't seem to impact hstspreload.org. I haven't yet dug into why that is.
The change to hstspreload API doesn't fix the problem on hstspreload.org because the website does not use the API :-D
As I stated on chromium/hstspreload#102 (comment), the website uses its own cache of domain states stored in datastore, supposedly to avoid loading the preload list in each request.