For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jwood2's avatar
jwood2
Icon for Nimbostratus rankNimbostratus
Feb 04, 2020

HTTP -> HTTPS redirect described in K26312346 failed pentest scan

I recently had a pentest performed against a virtual server and the implementation I chose for HTTP to HTTPS redirection failed the audit. I had implemented the HTTP to HTTPS policy described in K26...
LTM
security
jwood2's avatar
jwood2
Icon for Nimbostratus rankNimbostratus
Feb 04, 2020

I agree that the finding is a bit weak but I'm still obligated to address it. What being said, I agree with you that the easiest way to fix this is probably with an iRule, but I was wondering specifically how I could implement this sanity check for '[HTTP::uri] starts_with "/"' in a policy. I think I found my answer, within the policy I have configured:

Match all the following conditions:

HTTP URI path begins with any of / at request time

Do the following when traffic is matched:

Redirect to location tcl:https://[getfield [HTTP::host] : 1][HTTP::uri] at request time