HSTS (HTTP Strict Transport Security)

Ekanath,

 

 

I understand that the issue here, and how HSTS solves things, is the redirect itself being insecure. This redirect is over cleartext and, hence, susceptible to mitm attacks. HSTS will amend the initial request to https to get round this so all session info is encrypted.

 

 

Anyway, you're got an issue when using the iRule. Looking at your iRule above - have you copied it incorrectly? You seem to be missing a couple of lines which sets the variable.

 

 

Obvious one - but you'll need a vip listening on 443 too for this to work and, without double checking, do all browsers / versions support the Strict-Transport-Security? I know firefox does. I'll have to remind myself on that one too.

 

 

Hope this helps,

 

N