Security Headers Insertion

[JRahm]

Problem this snippet solves:

Centralize the security header management for one or more domains on the recommendation of SecurityHeaders.io.

Be warned!! You can really do damage to your availability if you do not understand these headers and their implications to your client browsers, make sure your header values are tested and vetted before applying to any production traffic.

Background on the headers:

• Content-Security-Policy
• X-Frame-Options
• X-XSS-Protection
• X-Content-Type-Options
• Public-Key-Pins
• Strict-Transport-Security

How to use this snippet:

apply this iRule to your virtual servers, once customized for your environment.

Code :

when RULE_INIT {
  set static::fqdn_pin1 "X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg="
  set static::fqdn_pin2 "MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec="
  set static::max_age 15552000
}
when HTTP_REQUEST {
  HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]"
}
when HTTP_RESPONSE {
  #HSTS
  HTTP::header insert Strict-Transport-Security "max-age=$static::max_age; includeSubDomains"
  #HPKP
  HTTP::header insert Public-Key-Pins "pin-sha256=\"$static::fqdn_pin1\" max-age=$static::max_age; includeSubDomains"
  #X-XSS-Protection
  HTTP::header insert X-XSS-Protection "1; mode=block"
  #X-Frame-Options
  HTTP::header insert X-Frame-Options "DENY"
  #X-Content-Type-Options
  HTTP::header insert X-Content-Type-Options "nosniff"
  #CSP
  HTTP::header insert Content-Security-Policy "default-src https://devcentral.f5.com/s:443"
  #CSP for IE
  HTTP::header insert X-Content-Security-Policy "default-src https://devcentral.f5.com/s:443"
}

Tested this on version:

12.0

[DJDX21_252164]

If the headers are already present in case of HSTS or Content security policy one can override with the new header by removing the old header Like this: ~~~ when HTTP_RESPONSE { set strictTransportSecurityHeader {"Strict-Transport-Security"} if { [HTTP::header exists $strictTransportSecurityHeader] } { HTTP::header remove $strictTransportSecurityHeader } HTTP::header insert Strict-Transport-Security "max-age=31536000; includeSubDomains" } ~~~

[JRahm]

yep, you can remove and insert, or a replace instead.

[Vince_212173]

Good stuff

[magnus78_287184]

Are these possible to insert on APM Webtops? edit added a working irule for this on apm 13.0.

when HTTP_RESPONSE { if {!( [HTTP::header "X-XSS-Protection"] eq "1; mode=block") }{ HTTP::header replace X-XSS-Protection "1; mode=block" }

if {!( [HTTP::header "X-Content-Type-Options"] eq "nosniff") }{
    HTTP::header replace X-Content-Type-Options "nosniff"
}
if {!( [HTTP::header "Content-Security-Policy"] eq "frame-ancestors *;script-src 'self' 'unsafe-inline' 'unsafe-eval' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: ; connect-src 'self' wss:;") }{
    HTTP::header replace Content-Security-Policy "frame-ancestors *;script-src 'self' 'unsafe-inline' 'unsafe-eval' ; style-src 'self' 'unsafe-inline' ; img-src 'self' data: ; connect-src 'self' wss:;"
}

log local0. "irule working"

}

[AlexDeMarco]

What is the purpose of having this: when HTTP_REQUEST { HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]" }

[waleed_osama_23]

I'm really interested to know why the 301 is needed as well, someone please respond if you have any idea

[JRahm]

The 301 should really be only for requests to the http vip. Including the explicit redirect to ssl is considered best practice for capturing the first (pre-hsts-enabled) request.

[waleed_osama_23]

Hi Jason I have a question on HSTS. Isnt it useless on F5 since it won't serve any non https requests anyway on the VS?

[JRahm]

HSTS isn't a helpful server-side setting anyway, it's a client-side protection you enable on the server-side.

[Mohanad]

i Tried this but not worked

[James_Gill_4496]

Think your problem might be simply changing "when HTTP_REQUEST" to "when HTTP_RESPONSE"

Hope this helps.

[Mohanad]

Thanks, James, the syntax should be:

X-Content-Type-Options: nosniff

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Strict-Transport-Security: max-age=16070400

content-security-policy: options and value

[P_Kueppers]

I would recommend this to be done over Policies instead of iRules. Simply go to Local Traffic -> Policies and create a new Policy. From there you can add multiple rules in one policy like something like that:

It used less cpu ressources that iRules and is a bit easier to set up.

[Arun_LK_202176]

Could you forward the polocies for all the headers shown in the list. Please.

[P_Kueppers]

Sorry for the late answer. Thats not a big deal. You should read a bit about the headers and take your favorite option and write them as same as the example rule above.

But I took a few screenshots 😉

Insert only if not matched: Insert All Traffic: Insert only if not matched:

[Arun_LK_202176]

Hi Kueppers,

Could you assist with Strict-Transport-Security. AM not able to achieve it. Also, any links to headers would be much appreciated.

Thanks, Arun.

[P_Kueppers]

Hi Arun,

Im so sorry Im replying so late. I didnt get a notification 😞

We are not using the Header for STS. But from the example in the first post do something like:

"Match all of the following conditions": ALL

"Do the following": "Insert" - "http header" - named: "Strict-Transport-Security" with value "max-age=$static::max_age; includeSubDomains"

This should work.

Infos: https://www.keycdn.com/blog/http-security-headers/

[Nagesh08_254834]

Hi Jason,

After using the above irule in our APM, we are facing the issues. Where users are not able to connect VPN. If i remove the I rule it starts working.

Using the above irule is fixing my security header vulnerability issues reported by qualys, but creating VPN issues. How can I overcome this situation?

[JRahm]

Hi Nagesh08, ask a question in Q&A and post the entirety of your iRule there. If not modified for your personal environment, and especially with APM considerations, I wouldn't anticipate it would be a clean drop and insert.

[Nagesh08_254834]

Hi Jason,

code is as same as above,

when RULE_INIT { set static::fqdn_pin1 "X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg=" set static::fqdn_pin2 "MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec=" set static::max_age 15552000 } when HTTP_REQUEST { HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]" } when HTTP_RESPONSE { HSTS HTTP::header insert Strict-Transport-Security "max-age=$static::max_age; includeSubDomains" HPKP HTTP::header insert Public-Key-Pins "pin-sha256=\"$static::fqdn_pin1\" max-age=$static::max_age; includeSubDomains" X-XSS-Protection HTTP::header insert X-XSS-Protection "1; mode=block" X-Frame-Options HTTP::header insert X-Frame-Options "DENY" X-Content-Type-Options HTTP::header insert X-Content-Type-Options "nosniff" CSP HTTP::header insert Content-Security-Policy "default-src ; CSP for IE HTTP::header insert X-Content-Security-Policy "default-src ; }

As i found the code here, i am seeking your help.

Thank you

[Fallout1984]

Here's a link to an online tool to check a site's security headers (in case anyone didn't already have one):

https://geekflare.com/tools/secure-headers-test