Forum Discussion
NimbostratusHSTS via irule
I have 2 irules. 1 for HTTP HSTS and the other for HTTPS HSTS. they insert the headers but hsts is not enabled. I am running 11.5.4 so the HSTS config is not in my HTTP profile, how can I enable it through an irule?
** iRule for HSTS HTTP Virtuals
when HTTP_REQUEST {
HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]"
} **
iRule for HSTS HTTPS Virtualswhen RULE_INIT {
set static::expires [clock scan 20110926]
}
when HTTP_RESPONSE {
HTTP::header insert Strict-Transport-Security "max-age=[expr {$static::expires - [clock seconds]}]; includeSubDomain"
}
Ilian_IvanovHello,
Your iRules looks fine. Are you sure that the HSTS is not enabled? You can test your SSL connection with https://www.ssllabs.com/ssltest/index.html and check the results.
Also, your can check your ltm logs for errors.
Regards
kolomAltostratus
Hello pedinopa,
You should enable HSTS only on virtual servers with client SSL profiles.You can enable HSTS on HTTPS Virtual server using the below iRule.
when HTTP_RESPONSE { if { !([ HTTP::header exists "Strict-Transport-Security“ ])} { HTTP::header insert "Strict-Transport-Security" "16070400" } }
pedinopa_170325according to ssllabs the HSTS headers are there but not enabled. I tried the irule you suggested did not make a difference.
- kolom
please post a snapshot of the part that is saying it's there but not enabled.
- pedinopa_170325
this is the snippit I took from the ssllabs report.
Strict Transport Security (HSTS)Disabled max-age=-199622101; includeSubDomains; enable
kolom_265617Cirrostratus
Hello pedinopa,
You should enable HSTS only on virtual servers with client SSL profiles.You can enable HSTS on HTTPS Virtual server using the below iRule.
when HTTP_RESPONSE { if { !([ HTTP::header exists "Strict-Transport-Security“ ])} { HTTP::header insert "Strict-Transport-Security" "16070400" } }- pedinopa_170325
according to ssllabs the HSTS headers are there but not enabled. I tried the irule you suggested did not make a difference.
- kolom_265617
please post a snapshot of the part that is saying it's there but not enabled.
- pedinopa_170325
this is the snippit I took from the ssllabs report.
Strict Transport Security (HSTS)Disabled max-age=-199622101; includeSubDomains; enable
JGCumulonimbus
The problem with your irule is that "20110926" is a past date. It needs to be a period of time starting from the runtime. Try this one:
when RULE_INIT { set static::expires [clock scan "12 month"] } when HTTP_RESPONSE { HTTP::header insert Strict-Transport-Security "max-age=[expr {$static::expires - [clock seconds]}]; includeSubDomain" }.
- pedinopa_170325
that did it thank you