For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ruggerfly1's avatar
Ruggerfly1
Icon for Nimbostratus rankNimbostratus
Feb 06, 2017

HSTS Irule and Validating Results

Good Morning, I have IRULES on the HTTP and HTTPS virtual servers to enforce HSTS, how can I test it's being inserted correctly? I used SSL Labs but the Server Scan didn't exactly give me what I was...
iRules
LTM
security
Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Feb 06, 2017

Hi Ruggerfly,

 

the provided iRule looks good.

 

You can test your HSTS setup, by accessing the web site as usual. Then close the browser and try to access the page again via plain-text HTTP. The client should immediately switch to HTTPS without sending a single HTTP request over the wire (can be verified via TCPDUMP, Fiddler2, HTTPWatch, etc. request captures).

 

Note: You may also compare the issued HSTS header and the SSL-Labs results of https://devcentral.f5.com with your results. F5 has deployed very strict SSL settings with HSTS support.

 

Cheers, Kai