Forum Discussion

pedinopa_170325's avatar
pedinopa_170325
Icon for Nimbostratus rankNimbostratus
Jan 22, 2018

HSTS via irule

I have 2 irules. 1 for HTTP HSTS and the other for HTTPS HSTS. they insert the headers but hsts is not enabled. I am running 11.5.4 so the HSTS config is not in my HTTP profile, how can I enable it...
iRules
security
kolom_265617's avatar
kolom_265617
Icon for Cirrostratus rankCirrostratus
Jan 22, 2018

Hello pedinopa,

You should enable HSTS only on virtual servers with client SSL profiles.You can enable HSTS on HTTPS Virtual server using the below iRule.

when HTTP_RESPONSE { 
if { !([ HTTP::header exists "Strict-Transport-Security“ ])} 
{ HTTP::header insert "Strict-Transport-Security" "16070400" } 
}
pedinopa_170325's avatar
pedinopa_170325
Icon for Nimbostratus rankNimbostratus
Jan 22, 2018

this is the snippit I took from the ssllabs report.

 

Strict Transport Security (HSTS)Disabled max-age=-199622101; includeSubDomains; enable