title: How HSTS expiration works
body: <p>In ASP.NET Core 2.2 application we have enabled HSTS using <code>app.UseHsts();</code> which adds HSTS with <code>max-age</code> of 30 days in the response header.</p>
  
  <p>In the fiddler</p>
  
  <pre><code>Strict-Transport-Security: max-age=2592000
  </code></pre>
  
  <p>Then in Chrome, if I go to <code>chrome://net-internals/#hsts</code> and query our domain name, I get:</p>
  
  <p><strong>Found:</strong></p>
  
  <pre><code>static_sts_domain:  
  static_upgrade_mode: UNKNOWN  
  static_sts_include_subdomains:  
  static_sts_observed:  
  static_pkp_domain:  
  static_pkp_include_subdomains:  
  static_pkp_observed:  
  static_spki_hashes:  
  dynamic_sts_domain: subdomain.example.com //our domain name here  
  dynamic_upgrade_mode: FORCE_HTTPS  
  dynamic_sts_include_subdomains: false  
  dynamic_sts_observed: 1572023505.777819  
  dynamic_sts_expiry: 1574615505.777818  
  </code></pre>
  
  <p><strong>Questions</strong>  </p>
  
  <ol>
  <li>What is the unit of <code>dynamic_sts_observed</code> and <code>dynamic_sts_expiry</code>. It does not look like it's in seconds. How is the value calculated?  </li>
  <li>If user keeps visiting site every day, does the value keep updating? In other words, is it sliding expiration?   </li>
  <li>What happens after expiry?   </li>
  <li>What happens if user has already visited the site and his browser already cached HSTS for 30 days. But in couple of days we changed the value from 30 days to 90 days. When would user's browser get the updated value? After expiry or on next visit?  </li>
  <li>the URL user browse is already a subdomain like <code>https://subdomain.example.com</code> The SSL certificate we use is wildcard certificate. <code>*.example.com</code>. So HSTS configuration do i need to includeSubdomain? 
  like <code>Strict-Transport-Security: max-age=2592000, includeSubDomain</code></li>
  </ol>