---
title: Migrating F5 iRules Security Headers to RELIANOID Farms Configuration
description: "## Overview This article explains how to migrate a common F5 BIG-IP iRule used for HTTP security header insertion into RELIANOID using native HTTP/S farm features. The following iRule injects several HTTP response security headers: ``` when HTTP_RESPONSE_RELEASE { if…"
url: "https://www.relianoid.com/resources/knowledge-base/troubleshooting/migrating-f5-irules-security-headers-to-relianoid-farms-configuration/"
updated: "2026-05-07"
category: Troubleshooting
---

# Migrating F5 iRules Security Headers to RELIANOID Farms Configuration

## Overview

This article explains how to migrate a common F5 BIG-IP iRule used for HTTP security header insertion into RELIANOID using native HTTP/S farm features.

The following iRule injects several HTTP response security headers:

```
when HTTP_RESPONSE_RELEASE {

    if {!([ HTTP::header exists "X-XSS-Protection"])} {
        HTTP::header insert "X-XSS-Protection" "1; mode=block"
    }

    if { !([ HTTP::header exists "Strict-Transport-Security" ])} {
        HTTP::header insert "Strict-Transport-Security" "max-age=63072000; includeSubDomains; preload"
    }

    if { !([ HTTP::header exists "content-security-policy" ])} {
        HTTP::header insert "content-security-policy" "frame-ancestors 'none'"
    }

    if {!([HTTP::header exists "X-Content-Type-Options" ])} {
        HTTP::header insert "X-Content-Type-Options" nosniff
    }
}
```

In RELIANOID, these security controls can be configured directly through the WebUI without requiring TCL scripting.

## Enabling HSTS (Strict-Transport-Security)

**HSTS** forces browsers to use HTTPS connections only. Benefits include:

- Preventing SSL stripping attacks
- Enforcing encrypted communications
- Improving browser-side transport security

The following iRule section:

```
HTTP::header insert "Strict-Transport-Security" "max-age=63072000; includeSubDomains; preload"
```

Can be migrated directly through the WebUI.

Navigate to: **Farms > HTTP/S Farm > Services**

Then:

- Select the desired HTTP/S service
- Enable the STS switch

This automatically injects the `Strict-Transport-Security` header into HTTPS responses.

## Configuring X-XSS-Protection Security Header

Enables legacy browser XSS filtering. Although modern browsers rely more heavily on CSP, this header is still useful for compatibility scenarios.

Navigate to: **Farms > HTTP/S Farm > Global > Advanced > Headers**. Then: Click `Create rule`. Select:

Type: `Response: Add header`
 Header: `X-XSS-Protection`
 Value: `1; mode=block`

## Configuring Content-Security-Policy Security Header

Controls how content can be embedded and loaded. Benefits:

- Prevents clickjacking
- Restricts unauthorized framing
- Improves browser security posture

Navigate to: **Farms > HTTP/S Farm > Global > Advanced > Headers**. Then: Click `Create rule`. Select:

Type: `Response: Add header`
 Header: `Content-Security-Policy`
 Value: `frame-ancestors 'none'`

## Configuring X-Content-Type-Options Security Header

Prevents MIME sniffing by browsers. Benefits:

- Prevents malicious content interpretation
- Reduces certain script injection vectors

Navigate to: **Farms > HTTP/S Farm > Global > Advanced > Headers**. Then: Click `Create rule`. Select:

Type: `Response: Add header`
 Header: `X-Content-Type-Options`
 Value: `nosniff`

## Validation

After applying the configuration, validate response headers using:

```
curl -I https://<Farm VIP>
```

Expected output:

```
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-XSS-Protection: 1; mode=block
Content-Security-Policy: frame-ancestors 'none'
X-Content-Type-Options: nosniff
```

## Troubleshooting

### Headers Not Appearing

Verify:

- Rules are applied to the correct farm
- **HTTPS** is enabled for **HSTS**
- Header rules are configured as **Response** rules
- Farm configuration has been applied/reloaded

### Duplicate Headers

If the backend application already injects headers, duplicates may appear. Recommendation:

- Decide whether headers should be managed by the Backend application or by RELIANOID farm configuration
- Avoid managing the same headers in both places.

### HSTS Not Working

Ensure:

- Clients connect via HTTPS
- Valid SSL certificates are installed
- Browsers are not testing via HTTP

HSTS headers are ignored on non-TLS connections.

## Summary

F5 iRules used for HTTP security header insertion can be migrated to RELIANOID using native HTTP/S farm features without TCL scripting.

This approach simplifies administration while maintaining equivalent security functionality.

### 📄 Download this document in PDF format