For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jwood2's avatar
jwood2
Icon for Nimbostratus rankNimbostratus
Feb 04, 2020

HTTP -> HTTPS redirect described in K26312346 failed pentest scan

I recently had a pentest performed against a virtual server and the implementation I chose for HTTP to HTTPS redirection failed the audit. I had implemented the HTTP to HTTPS policy described in K26...
LTM
security
nathe's avatar
nathe
Icon for Cirrocumulus rankCirrocumulus
Feb 04, 2020

I think I'm with the pentester on this and this is susceptible to MITM.

​

I would mitigate this by using HTTPS Strict Transport Security. See HSTS. ​

​

Hope this helps,

​

N​