Forum Discussion
pedinopa_170325
Nimbostratus
NimbostratusHSTS not enabled
I found the iRules for implementing HSTS. They are inserting the headers but according to SSL labs the header is disabled. Why is this>
1: iRule for HSTS HTTP Virtuals 2: 3: when HTTP_REQUEST { 4: HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]" 5: } 6:
7: iRule for HSTS HTTPS Virtuals 8: 9: when RULE_INIT { 10: set static::expires [clock scan 20110926] 11: } 12: when HTTP_RESPONSE { 13: HTTP::header insert Strict-Transport-Security "max-age=[expr {$static::expires - [clock seconds]}]; includeSubDomains" 14: }
Hi~
It seems, according to these articles, that the default is disabled. Maybe check settings to enable?
check out:
https://support.f5.com/csp/article/K40243113
About 2/3 down that last link has steps on how to enable and this video (https://youtu.be/2ykG3f4Kg_0) shows how to enable HSTS in a HTTP profile.
Hope that helps
ps
JGCumulonimbus
It looks like you copied some old example code. Change
set static::expires [clock scan 20110926]to
static::expires [clock scan "12 month"]
