Forum Discussion

Chintu's avatar
Chintu
Icon for Nimbostratus rankNimbostratus
May 27, 2021

Setting HSTS header and SSL offload

Hi everyone,

 

We are planning to enforce STS header for all our sites through F5 . But the problem is, we are doing SSL offloading at F5 and all content will be served over http to F5.

 

If we set STS on F5, won't it cause a problem doing SSL offloading as the resources might become unavailable when accessing over http?

BIG-IP
iRules
security
  • Nicolas_Martin-'s avatar
    Nicolas_Martin-
    Icon for Cirrus rankCirrus
    May 27, 2021

    Hi!

    If you configure HSTS on F5 only on client-side, your F5 will still be able to retrieve resources from HTTP backend.

    If your client computer tries to reach backend server directly using HTTP and bypassing F5 their browser will complain about HSTS as soon they got the HSTS policy by reaching application through F5.

    Regards,