clarify ""Max-age > 10 years" warning

chromium / hstspreload

🔒🔍 A Go package to scan sites against requirements for Chromium-maintained HSTS preload list.

https://hstspreload.org

BSD 3-Clause "New" or "Revised" License

114 stars 37 forks source link

Open teh-maxh opened 3 years ago

teh-maxh commented 3 years ago

The warning for a max-age > 10 years does not currently explain why that may be an issue. Explanatory text added.

lgarron commented 3 years ago

For what it's worth, I believe:

Firefox still has no limit on the max-age.
Chrome still has a limit of 1 year. I tried to raise that to 2 years but was not successful: https://bugs.chromium.org/p/chromium/issues/detail?id=692348 (Although perhaps the concerns are no longer as valid now that HTTPS is easier than ever.)