Vulnerability - HSTS header does not contain includeSubDomains

[Deepak25]

This vulnerability is detected on global protect public ip.

HSTS header does not contain includeSubDomains

The HTTP Strict Transport Security (HSTS) header does not contain the includeSubDomains directive. This directive instructs the browser to also enforce the HSTS policy over subdomains of this domain.
Expected Headers > strict-transport-security: max-age=[anything]; includeSubDomains; ...
Actual max-age=31536000;

Panos version installled 9.1.7.

anyone aware about this vulnerability and resolution ?

[shubhamgupta]

Hi @Deepak25 

Am also facing the same issue, Did you find any resolution for the same.

[ymiyashita]

Currently, it's considered as designed since Strict-Transport-Security is only for the Global Protect server itself and we don't have control for the sub domains.
We have a feature request (FR 17182) for this. You may want to contact Palo Alto Networks sales department to add more weight.

[MALLIKARJUN-SHIGLI]

Any update on the SubDomains, when it's planned for a release.

[shubhamgupta]

I got this below response from TAC for above vulnerability-

Apologies for delayed response.

We have checked internally and from the information we are not supporting HSTS for subdomain.

We would reach out to your account team to get the feature in Firewall for GP VPN.

As, we raised voting request with our internal team for your Feature request with FR ID: 6826.

[Mignone35]

Any update on the SubDomains?

[MingWang]

I have the same issue too.

And I also want to know does there any update about SubDomins.

[MBTNA]

I have the same problem

[BigPalo]

any update? im the same

[AllwynMascarenhas]

seems like everyones been waiting for long on this one, we got a similar customer request.. anyone checked this in v10?

[ElvisJan]

Paloalto support portal mentioned the includeSubDomains directive is not relevant to GlobalProtect because it is not a hosted website whereby statically defined. No resolution, it is expected behavior. 
GlobalProtect HTTP header missing includeSubDomains in Strict-T... - Knowledge Base - Palo Alto Netw...