Forum Discussion

fcceng_247738's avatar
fcceng_247738
Icon for Nimbostratus rankNimbostratus
Feb 03, 2016

Configure Public Key Pinning (HPKP) header in LTM 11.6

Has anyone configured the HTTP Public-Key-Pins response header (rfc 7469) in LTM 11.6?

 

BIG-IP
devops
LTM
security

3 Replies

  • Chris_Grant's avatar
    Chris_Grant
    Icon for Employee rankEmployee
    Feb 03, 2016

    This is not something that is natively supported in 11.6.0, though there is a tracking ID to add it to a future release. You can open a support case and ask to have your case linked against ID 517825. This functionality won't likely find it's way backwards to 11.6.0, though.

     

  • awilhelm's avatar
    awilhelm
    Icon for Employee rankEmployee
    Feb 03, 2016

    You can insert headers in responses by calling 

    HTTP::header insert
    in the 
    HTTP_RESPONSE
    event in an iRule. See the 
    HTTP::header
    documentation for more info: https://devcentral.f5.com/wiki/iRules.HTTP__header.ashx

    Due to the nature of the information required in RFC 7469, you would unfortunately need to prepare a static header to be inserted and update it as needed when certificates potentially change.

  • BAMcHenry's avatar
    BAMcHenry
    Ret. Employee
    May 12, 2016
    A bit more detail on how to insert HPKP headers: https://devcentral.f5.com/s/articles/20-lines-or-less-security-headers-18367