For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

muyal_222536's avatar
muyal_222536
Icon for Nimbostratus rankNimbostratus
Sep 18, 2015

Mixed Content due to HTTP 302 response

Hi All

 

We have a web application running on port 8080 also we have a iRule rewrites to HTML using stream profile.So all content is rewritten from http to https.

 

However when the home page loads, we get a HTTP 302 re-direct caught and browser (IE 9) warning about mixed content. Used Fiddler to get the HTTP response header, which has been rewritten to HTTPS but brower still warns because of the HTTP 302 redirect.

 

How do we resolve this, please help

 

Kind Regards Commandon

 

application delivery
deployment
devops
iRules
LTM
microsoft
security

2 Replies

  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Sep 18, 2015

    The only time I have seen this is when there is one element within the home page that is pulling an element in http. For example a hidden iFrame or something.

     

    Have you scrubbed the entire home page for that? -=Bhattman=-

     

  • muyal_222536's avatar
    muyal_222536
    Icon for Nimbostratus rankNimbostratus
    Sep 18, 2015

    Yes, used fiddler , which found a HTTP response on 302 coming from a CSS file, which is what the client/browser is moaning about.

     

    Looking up, the URL was re-written to HTTPS, but still the browser picks up HTTP 302 and warns. The easy fix would be to allow mixed content via IE settings however that's not an option because SSL lock will be lost.

     

    So our stream profile finds any HTTP within the page to re-direct but wouldn't re-direct HTTP header.

     

    HTH

     

    Thanks C