Forum Discussion

Julio_Navarro's avatar
Julio_Navarro
Icon for Cirrostratus rankCirrostratus
Oct 28, 2020
Solved

to HSTS or not to HSTS

Hello, we have several 100's applications where are only exposed on port 443 with its proper certificate. We don't have any VIP on other port redirect to 443. Now, enabling HSTS will bring me more se...
application delivery
BIG-IP
hsts
LTM
  • wlopez's avatar
    wlopez
    Oct 28, 2020

    An important thing to consider with your application development teams is that they need to make sure their code doesn't include calls for the client's browser to load things like (Ex. javascript, fonts, google analytics) from third party locations without https.

    You might run into situations where you insert the header in the responses and then the client's browser will fail to load fonts o plugins from http reference links, which might degrade the application's performance or break the application alltogheter.

    Ideally you should test this on non-production environments first.

     

    Hope that helps.

wlopez's avatar
wlopez
Icon for Cirrocumulus rankCirrocumulus
Oct 28, 2020

An important thing to consider with your application development teams is that they need to make sure their code doesn't include calls for the client's browser to load things like (Ex. javascript, fonts, google analytics) from third party locations without https.

You might run into situations where you insert the header in the responses and then the client's browser will fail to load fonts o plugins from http reference links, which might degrade the application's performance or break the application alltogheter.

Ideally you should test this on non-production environments first.

 

Hope that helps.