For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

boneyard's avatar
boneyard
Icon for MVP rankMVP
Jun 16, 2014

HSTS domain

not really an F5 question, but i do use an iRule to insert the header :)   does anyone has actual experience with HSTS* and on what level it is active? i read everywhere about the HSTS domain, so ...
application delivery
design
devops
hsts
iRules
LTM
security
boneyard's avatar
boneyard
Icon for MVP rankMVP
Jun 17, 2014

based on some testing (Chrome 35, FireFox 28 / 30) i determined it is set on a host basis, not domain. so when i set the header for host1.domain.ext, then it is active for host1.domain.ext only. not for domain.ext and host2.domain.ext.