For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Thomas_Schaefer's avatar
Thomas_Schaefer
Icon for Nimbostratus rankNimbostratus
Apr 03, 2018

HSTS header in policy is NOT sent when redirecting

We are inserting an HSTS header using a policy (v 12). When a request comes into our virtual server, if the URI is just /, we have an iRule that will redirect the browser to a specific application. F...
application delivery
iRules
Abdessamad1's avatar
Abdessamad1
Icon for Cirrostratus rankCirrostratus
Apr 06, 2018

Dear,

 

Concerning the processing order, you should note that the iRules are evaluated after the LTM policies: https://support.f5.com/csp/article/K16590

 

But the event order is also important, iRule based redirect will cause any response based action not to be fired.

 

So if you're relying a lot more on the LTM policies, I suggest that you perform your redirects via policies as well, and include there the hsts header.

 

Regards.