F5 Big IP HSTS - Revision history

Busk at 04:02, 16 August 2022

2022-08-16T04:02:54Z

2022-03-02T07:33:50Z

2022-01-14T16:20:56Z

2022-01-14T04:15:41Z

2022-01-12T20:33:19Z

2022-01-12T19:30:05Z

2022-01-12T18:52:06Z

Created page with "https://support.f5.com/csp/article/K68657325"

New page

https://support.f5.com/csp/article/K68657325

← Older revision		Revision as of 04:02, 16 August 2022
Line 6:		Line 6:
	```		```

		+	301 redirect
		+	https://support.f5.com/csp/article/K30114265
		+
		+	VS response
		+	https://support.f5.com/csp/article/K68657325

← Older revision		Revision as of 07:33, 2 March 2022
Line 1:		Line 1:
		+	set it for a redirect
		+	```
		+	HTTP::respond 301 Location "https://www.example.com[HTTP::uri]" Strict-Transport-Security "max-age=31536000"
		+
		+	default { HTTP::respond 301 Location "https://www.example.com[HTTP::uri]" Strict-Transport-Security "max-age=31536000"; persist none }
		+	```
		+
		+
		+
	https://hstspreload.org/		https://hstspreload.org/

← Older revision		Revision as of 16:20, 14 January 2022
Line 1:		Line 1:
		+	https://hstspreload.org/
		+
		+
	https://stackoverflow.com/questions/42866025/do-i-need-to-enable-hsts-in-addition-to-forcing-https-in-htaccess		https://stackoverflow.com/questions/42866025/do-i-need-to-enable-hsts-in-addition-to-forcing-https-in-htaccess

← Older revision		Revision as of 04:15, 14 January 2022
Line 1:		Line 1:
		+	https://stackoverflow.com/questions/42866025/do-i-need-to-enable-hsts-in-addition-to-forcing-https-in-htaccess
		+
		+
	https://support.f5.com/csp/article/K68657325		https://support.f5.com/csp/article/K68657325

← Older revision		Revision as of 20:33, 12 January 2022
Line 1:		Line 1:
	https://support.f5.com/csp/article/K68657325		https://support.f5.com/csp/article/K68657325

		+	```
	nmap -p 443 --script http-security-headers 10.x.x.y		nmap -p 443 --script http-security-headers 10.x.x.y
		+	```
		+
		+
		+	NGINX Example -
		+	```
		+	# Security headers
		+	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
		+	add_header X-Frame-Options DENY;
		+	add_header X-Content-Type-Options nosniff;
		+	add_header Content-Security-Policy "default-src 'self' www.google-analytics.com ajax.googleapis.com www.google.com google.com gstatic.com www.gstatic.com connect.facebook.net facebook.com;";
		+	add_header X-XSS-Protection "1; mode=block";
		+	add_header Referrer-Policy "origin";
		+	```
		+	https://serverfault.com/questions/874936/adding-hsts-to-nginx-config

← Older revision		Revision as of 19:30, 12 January 2022
Line 1:		Line 1:
	https://support.f5.com/csp/article/K68657325		https://support.f5.com/csp/article/K68657325
		+
		+	nmap -p 443 --script http-security-headers 10.x.x.y