Forum Discussion
Beinhard_8950
Nimbostratus
Sep 02, 2010Strict Transport Security
Hi,
I have a question, dows anyone implemented Strict Transport Security (STS/HSTS).
I have seen many guides to implement this on servers and so on but if you use a ADC then it would be...
JRahm
Admin
Sep 02, 2010Most of the controls for STS seem to occur on the client end. Implementing looks to be a fairly simple iRule, inserting a header with appropriate options for your policy and limiting access to non-ssl resources on the client-side. The problem is going to be handling non-compliant browsers. I know Chrome supports it already and FF4 will have it, but what about IE and the others? That's a large chunk of site visitors, so you would need a mechanism (simple HTTP::respond with "Please use browser X, Y, Z" would work) to inform the users. It's always tricky to enforce adoption without losing users.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects