Forum Discussion
Nandhi
Cirrus
Cirrushsts scan result none
We implemented hsts via irule. The ltm logs says headers are inserting but SSL labs results shows none. We tested the in chrome and can see the header values. Below is the rule.
HSTS for http vs:
when HTTP_REQUEST {
if { [ HTTP::has_responded]} {return}
HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]"
}
HSTS for https vs:
when RULE_INIT {
set static::expires [clock scan "12 month"] }
when HTTP_RESPONSE {
HTTP::header insert Strict-Transport-Security "max-age=[expr {$static::expires - [clock seconds]}]; includeSubDomains;preload"
log local0. "hsts Inserted" }
Any idea why its not flagged in scan results.
NandhiHi Edward,
The hsts already added via irule to the specific vs. We can see the inserted header in GET response and browser developer tools. But ssl labs not able to identify it (showing none).
- P_Kueppers
MVP
Why you insert it via irule and not via http profile? are you testing your http:// url or https:// url on ssllabs? Is there maybe any redirect going on and ssllabs isnt doing that redirect, but browser does?
- LiefZimmerman
Admin
That previous reply was a spammer. Sorry for the confusion.
