RFC 6797 Quiz

Q1: Which response may update the user agent's HSTS state?

Multiple Choice

A gateway observes three responses from api.example: one over plain HTTP, one over TLS with a certificate warning, and one over TLS with no underlying security error. Each carries Strict-Transport-Security: max-age=86400.

A. All three, because the field value has valid syntax B. The two TLS responses, including the one with a warning C. Only the error-free TLS response D. Only the plain-HTTP response, before any redirect occurs

**Explanation:** A: Valid field syntax is necessary but not sufficient; an STS field received over insecure transport is ignored. B: RFC 6797 Section 8.1 also requires the secure transport to have no underlying errors or warnings. C: The error-free secure response satisfies the transport precondition and can create or update the Known HSTS Host entry. D: Section 7.2 says an HSTS Host MUST NOT include the field in a response conveyed over insecure transport, and Section 8.1 requires the user agent to ignore it.

Q2: How must this URI be transformed before loading?

Multiple Choice

The user agent already knows service.example as an HSTS Host. It is asked to load http://service.example:8080/tasks.

A. Keep http and port 8080, then follow a server redirect B. Use https://service.example:8080/tasks C. Use https://service.example:443/tasks D. Reject every URI whose explicit port is not 443

**Explanation:** A: Section 8.3 requires the user agent to rewrite a matching HTTP URI before the load; it does not wait for an insecure server redirect. B: The scheme becomes https, and an explicit port other than 80 is preserved. C: Port 80 is converted to 443, but RFC 6797 does not replace every explicit port with 443. D: HSTS applies across ports; the rewritten HTTPS request may fail if that port does not offer TLS, but the non-443 port is not rejected merely for its number.

Q3: What must the user agent do after this certificate failure?

Multiple Choice

agent.example is a Known HSTS Host. TLS establishment fails hostname validation, although the user wants to click through the warning and continue.

A. Continue if the user acknowledges the hostname mismatch B. Retry once over HTTP and display the response as read-only C. Continue only when the cached HSTS policy was learned without includeSubDomains D. Terminate the connection without an HSTS click-through path

**Explanation:** A: User recourse would reopen the man-in-the-middle decision that HSTS is intended to remove. B: Falling back to HTTP contradicts the Known HSTS Host policy. C: includeSubDomains changes host coverage, not the handling of secure-transport errors for a covered host. D: RFC 6797 Section 8.4 requires termination on any underlying secure-transport error. Section 12.1 explains the corresponding no-user-recourse behavior.

Q4: Does HSTS still cover the child host?

Multiple Choice

example.com has an unexpired HSTS policy with includeSubDomains. Later, api.example.com sends a valid error-free TLS response containing Strict-Transport-Security: max-age=0.

A. No; the child response deletes both the child and parent policies B. No; an exact-host max-age of zero always overrides a superdomain match C. Yes; the child removes only its own entry and remains covered by the parent D. Yes; max-age of zero is ignored whenever a parent policy exists

**Explanation:** A: RFC 6797 Sections 5.3 and 8.1.1 keep policies per issuing host; the child cannot delete the parent's entry. B: A zero lifetime removes the child's independently stored policy, but it is not an exclusion from parent coverage. C: Domain matching in Sections 5.4 and 8.2 still finds the unexpired parent whose includeSubDomains directive is asserted. D: The child field is processed and its own entry is removed; continued coverage comes from the separate parent entry.

Q5: Which review conclusion correctly states the bootstrap boundary?

Multiple Choice

A new A2A dashboard redirects HTTP to HTTPS and sends Strict-Transport-Security: max-age=31536000; includeSubDomains; preload on its HTTPS responses. The team claims RFC 6797 alone protects a first-time browser before it has contacted the site.

A. Correct; a long max-age retroactively protects the first HTTP request B. Incorrect; learned HSTS has a first-contact gap, and preloading is separate C. Correct; RFC 6797 defines preload as a required STS directive D. Incorrect; HSTS never applies until the user manually approves the host

**Explanation:** A: A policy received later cannot secure an earlier insecure request. B: Section 14.6 identifies the bootstrap MITM vulnerability, and Section 12.3 discusses a pre-loaded Known HSTS Host list as a user-agent facility. RFC 6797 itself defines only max-age and includeSubDomains as STS directives. C: preload is not a directive defined by RFC 6797, even though browser enrollment programs may use that token operationally. D: A valid field received over error-free secure transport can establish policy automatically; manual approval is not required.

Q6: What may the backend conclude from successful HSTS/TLS enforcement?

Multiple Choice

A browser reaches an A2A gateway through a Known HSTS Host with error-free TLS. The gateway forwards an Agent Card, a bearer grant, and a requested high-impact task to a backend. The design proposes treating the successful browser connection as proof that the card, grant, sender runtime, task parameters, and onward delegation are all authorized.

A. Accept all claims because HSTS turns a secure host connection into end-to-end task authorization B. Accept the card and grant automatically, but recheck only the task's monetary limit C. Treat HSTS as transport enforcement; validate each application claim under its own protocol and policy D. Reject the request because HSTS forbids gateways from forwarding application credentials

**Explanation:** A: RFC 6797 controls user-agent transport behavior; it does not define Agent Card integrity, token validation, runtime attestation, task approval, or delegation semantics. B: Neither the card nor the grant becomes valid merely because the browser reached the gateway through an HSTS-protected connection. C: RFC 6797 Sections 5.2, 8.3, and 8.4 define transport-policy enforcement, URI rewriting, and secure-transport error handling. The application decisions remain independent: relevant A2A, signature, OAuth, sender-constraining, and authorization rules must establish the additional claims, including the gateway-to-backend trust boundary. D: RFC 6797 neither authorizes nor prohibits application-level credential forwarding; that decision belongs to other protocols and the system's trust model.

HTTP Strict Transport Security

References (URLs)

Q1: Which response may update the user agent's HSTS state?

Q2: How must this URI be transformed before loading?

Q3: What must the user agent do after this certificate failure?

Q4: Does HSTS still cover the child host?

Q5: Which review conclusion correctly states the bootstrap boundary?

Q6: What may the backend conclude from successful HSTS/TLS enforcement?