Forum Discussion
NimbostratusAdding securityheaders
Hello,
I have a situation where there is many websites behind one virtual server and I would need to enable securityheaders.io recommended headers to responses.
Is there any ways to apply header only to one host which is behind the vip. HSTS would propably break something if applied to the VIP from etc. http profile?
And other question is about doing this in the webserver? Is there any reason those headers can't be added in IIS if f5 is doing ssl offloading or briding. Both offloading and bridging are used in same vip through policies.
Any help is much appreciated!
BR
Teemu
Lee_SutcliffeNacreous
This can easily be done per server IP on an HTTP response. For example:
when HTTP_RESPONSE { if {[IP:addr [IP:server_addr] equals 10.10.10.10]} { HTTP::header insert header-name header-value } }
Stanislas_Piro2Cumulonimbus
Hi,
Jason Rahm shared in codeshare section a ready to use irule about security headers insertion in HTTP responses:
https://devcentral.f5.com/codeshare/security-headers-insertion