Forum Discussion

DJDX21_252164's avatar
DJDX21_252164
Icon for Cirrus rankCirrus
May 17, 2016

Strict-Transport-Security (HSTS) header throws Operation not supported errors

This is my iRule to add "Strict-Transport-Security" header to my http response code.   when HTTP_RESPONSE { set strictTransportSecurityHeader {Strict-Transport-Security} if { [HTTP::head...
BIG-IP
devops
hsts
iRules
security
Stanislas_Piro2's avatar
Stanislas_Piro2
Icon for Cumulonimbus rankCumulonimbus
May 18, 2016

Hi,

The HSTS irule must be applied to HTTPS VS and not HTTP.

to be sure this irule is executed before other, you can add priority to this irule event and disable event if Policy action is redirect.

when HTTP_RESPONSE priority 1 {
if {[POLICY::targets http-reply] } {
    log local0. "LTM Policy action contains redirect. Disabling event"
    event disable
    return
}
 set strictTransportSecurityHeader "Strict-Transport-Security"
 if { [HTTP::header exists $strictTransportSecurityHeader] } { 
      HTTP::header remove $strictTransportSecurityHeader
 }
HTTP::header insert $strictTransportSecurityHeader "max-age=31536000; includeSubDomains"
}