Forum Discussion
HTTPS redirects for specific pages only
You're going go get this "insecure content" warning in many browsers when you try to access HTTP content where the browser believes it should only be talking HTTPS. It could be as simple as page object references (images, JavaScript, CSS, etc.) getting redirected to HTTP because they don't meet your "secured_uris" requirements. You can observe this behavior from a client side inspection tool like Fiddler or HTTPWatch. Or the browser could actually be choking on the back-and-forth flipping. In any case, this is a browser behavior, and not something you can specifically control with an iRule, other than to try to avoid it. Depending on what you see in your captures, you may need to expand your "secured_uris" list to contain page object references, or simply stay in HTTPS once the user has gone there. One might argue that if you're going to HTTPS to authenticate and then flipping back to HTTP for everything else, you're probably also exposing the authenticated session token (a cookie generated during the logon process to indicate the client's authenticated state) to unencrypted analysis (if that is how you maintain session state).
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com