Forum Discussion

Ruggerfly1's avatar
Ruggerfly1
Icon for Nimbostratus rankNimbostratus
Feb 06, 2017

HSTS Irule and Validating Results

Good Morning, I have IRULES on the HTTP and HTTPS virtual servers to enforce HSTS, how can I test it's being inserted correctly? I used SSL Labs but the Server Scan didn't exactly give me what I was expecting:

 

HSTS not in Chrome, Firefox, IE.

 

My config is: V11.5.3 HF2

 

**HTTP VIP IRULE when HTTP_REQUEST { HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]" }

 

**HTTPS VIP IRULE when RULE_INIT { set static::max_age 15552000 } when HTTP_RESPONSE { HSTS HTTP::header insert Strict-Transport-Security "max-age=$static::max_age; includeSubDomains" }

 

Many thanks,

 

iRules
LTM
security

1 Reply

Sort By
  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Feb 06, 2017

    Hi Ruggerfly,

     

    the provided iRule looks good.

     

    You can test your HSTS setup, by accessing the web site as usual. Then close the browser and try to access the page again via plain-text HTTP. The client should immediately switch to HTTPS without sending a single HTTP request over the wire (can be verified via TCPDUMP, Fiddler2, HTTPWatch, etc. request captures).

     

    Note: You may also compare the issued HSTS header and the SSL-Labs results of https://devcentral.f5.com with your results. F5 has deployed very strict SSL settings with HSTS support.

     

    Cheers, Kai