Forum Discussion

pedinopa_170325's avatar
pedinopa_170325
Icon for Nimbostratus rankNimbostratus
Jan 22, 2018

HSTS via irule

I have 2 irules. 1 for HTTP HSTS and the other for HTTPS HSTS. they insert the headers but hsts is not enabled. I am running 11.5.4 so the HSTS config is not in my HTTP profile, how can I enable it...
iRules
security
kolom's avatar
kolom
Icon for Altostratus rankAltostratus

Hello pedinopa,

You should enable HSTS only on virtual servers with client SSL profiles.You can enable HSTS on HTTPS Virtual server using the below iRule.

when HTTP_RESPONSE { 
if { !([ HTTP::header exists "Strict-Transport-Security“ ])} 
{ HTTP::header insert "Strict-Transport-Security" "16070400" } 
}
pedinopa_170325's avatar
pedinopa_170325
Icon for Nimbostratus rankNimbostratus
Jan 22, 2018

according to ssllabs the HSTS headers are there but not enabled. I tried the irule you suggested did not make a difference.