Strict Transport Security (HSTS) with Redirect

Products

• ProxySG Software - SGOS
• Advanced Secure Gateway Software - ASG
• ISG Proxy

Issue/Introduction

Is it possible for the proxy to perform a redirect and apply the HSTS header?

Using something like the following the Proxy does not seem to be adding the HSTS header when the traffic is redirected: 

<proxy>
 ALLOW url.scheme=http url.host=example.com action.Redirect_to_HTTPS_example1(yes)

define action Redirect_to_HTTPS_example1
   redirect( 302, "http://example.com(.*)", "https://example1.com/$(1)" )
 end action Redirect_to_HTTPS_example1

<proxy>
url.domain=example.com action.ControlResponseHeader_HSTS(yes)

define action ControlResponseHeader_HSTS
    set(response.x_header.Strict-Transport-Security, "max-age=300")
end action ControlResponseHeader_HSTS

Cause

The redirect is handled as an exception in the Proxy policy evaluation.

When doing the 301/302 redirect, you will see in the ptrace: 

verdict: REDIRECT(policy_redirect)

Resolution

Add the HSTS header using "exception.response.x_header.Strict-Transport-Security" 

define action ControlResponseHeader_HSTS_temp
     set(exception.response.x_header.Strict-Transport-Security, "max-age=300")
 end action ControlResponseHeader_HSTS_temp

When the 301/302 redirect happens, you will see this line in the Policy trace: 

set exception.response header 'Strict-Transport-Security'

Also, from the f12 developer tools: