For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Chintu's avatar
Chintu
Icon for Nimbostratus rankNimbostratus
May 27, 2021

Setting HSTS header and SSL offload

Hi everyone,   We are planning to enforce STS header for all our sites through F5 . But the problem is, we are doing SSL offloading at F5 and all content will be served over http to F5.   If ...
BIG-IP
iRules
security
Nicolas_Martin-'s avatar
Nicolas_Martin-
Icon for Cirrus rankCirrus
May 27, 2021

Hi!

If you configure HSTS on F5 only on client-side, your F5 will still be able to retrieve resources from HTTP backend.

If your client computer tries to reach backend server directly using HTTP and bypassing F5 their browser will complain about HSTS as soon they got the HSTS policy by reaching application through F5.

Regards,