Forum Discussion
Julio_Navarro
Cirrostratus
Cirrostratusto HSTS or not to HSTS
Hello, we have several 100's applications where are only exposed on port 443 with its proper certificate. We don't have any VIP on other port redirect to 443. Now, enabling HSTS will bring me more se...
An important thing to consider with your application development teams is that they need to make sure their code doesn't include calls for the client's browser to load things like (Ex. javascript, fonts, google analytics) from third party locations without https.
You might run into situations where you insert the header in the responses and then the client's browser will fail to load fonts o plugins from http reference links, which might degrade the application's performance or break the application alltogheter.
Ideally you should test this on non-production environments first.
Hope that helps.
Hello Julio.
HSTS header is only interpreted by client's browser. So, you only need to enable it during the clientside communciation (HTTP_RESPONSE).
On the other hand, you can offload traffic between F5 and backend server without any kind issue.
Regards,
Dario.