For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Steve_88099's avatar
Steve_88099
Icon for Nimbostratus rankNimbostratus
Nov 07, 2012

web services credentials passed over port 80 after http redirect is setup

Issue: Login prompt presented over plain http port 80 even though http redirect is set up.

 

I discovered our application group published a webservice using http basic authentication so I went to: (example)

 

http://ourdomain.com/groovey/service with my web browser and was prompted for user name and password

 

When I go to https://ourdomain.com/groovey/service the form pops up is shows 443.

 

 

If I do a similar test going to our main web login page over http I get redirected to the https version.

 

We have a Virtual Server set up with a HTTP class Profile defined with action Redirect to and location of : https://[HTTP::host][HTTP::uri]

 

 

So it appears credentials are being sent over clear text on port 80. How do I improve the config to ensure the entire conversation goes over https? I'm assuming there are more steps needed, any guidance would be much appreciated.

 

app sec
BIG-IP Access Policy Manager (APM)
security

1 Reply

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Nov 07, 2012
    How is the Virtual Server setup? Is it a wildcard? If not, what port does it listen on? Are there two VSs, one for port 80, one for 443?