For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

viks_96432's avatar
viks_96432
Icon for Nimbostratus rankNimbostratus
Oct 05, 2012

HTTPS header stripping

Does F5 by default do any HTTPS header stripping. There is a requirement not to strip off the HTTPS headers and am not sure if F5 does this by default :(.     We are using SSL client profile...
config
design
viks_96432's avatar
viks_96432
Icon for Nimbostratus rankNimbostratus
Oct 05, 2012
The SSL connections are terminated on the F5 and connection between F5 and pool member is not encrypted.

 

 

I believe there is a way you can strip off the HTTP header information as the connection go through an F5 using iRules, But my question is does F5 do this by default - This is useful in cases where sensitive information like user credentials are included in the http header.