Strict-Transport-Security header should specify the includeSubDomains directive

[stats_marketing]

Hi Community,

We ran a vulnerability scan and we are receiving a Vulnerability alert, not sure if it is truly false positive and the reasons behind it to demonstrate to client that this is may not be an actual vulnerability.

It looks like its in the Response headers when going to a Shopify store with HTTP requests.

[denis_l]

Any updates on this issue? More specifically, we should be able to set

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

to enable HSTS preload on a custom domain.

[stats_marketing]

Not currently an update as of this date, however...

I was told that those on Shopify Plus can send a Vulnerability Report and their secure team can analyze it and let you know if they will modify it for you or tell you why it is a false-positive.

We may plan on doing this, so I will keep you posted.

[pep1]

Hey @stats_marketing - did you ever get an update about this?