For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

David_Bohls_209's avatar
David_Bohls_209
Icon for Nimbostratus rankNimbostratus
Mar 03, 2011

301 Redirect to different port (iRule "Rewrite Redirect"

I currently have an issue where a client of mine is producing (301 302 305 etc...) redirects for certain traffic arriving on http://www.url.com:8081. The current iRule was not set up by me, and I believe is producing the wrong result. Redirects are being translated to https://www.url.com:8081.

 

 

I need the redirects to simply go to https://www.url.com.

 

 

Do I need to change my iRule below? or Will "Rewrite Redirect" solve the issue?

 

 

This iRule is listening for the server's redirect then trying to change the URL.

 

 

when HTTP_RESPONSE {

 

if { [HTTP::is_redirect] } {

 

HTTP::respond 301 Location "[string map { http:// https:// } [HTTP::header Location]]"

 

 

}

 

}

 

 

Any help would be awesome. Thanks.

 

 

Dave

 

application delivery
dev
devops
iRules

3 Replies

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Mar 03, 2011
    That's because your iRUle is simply replacing http:// with https://. My more generic one that I usually implement uses the host: header to generate the redirect. e.g. (No checking, so probably some typos in here) 

    
  when HTTP_REQUEST {
 
    Check if Host header value has a length
   if {[string length [HTTP::host]]}{
 
       Redirect to the requested host and URI (minus the port if specified)
      log local0. "ssl-redirect-301 https://[getfield [HTTP::host] ":" 1][HTTP::uri]"
      HTTP::respond 301 Location https://[getfield [HTTP::host] ":" 1][HTTP::uri]
 
   } else {
 
       Redirect to VIP's IP address
      log local0. "ssl-redirect-301 https://[IP::local_addr][HTTP::uri]"
     HTTP::respond 301 Location https://[IP::local_addr][HTTP::uri]
   }
}

    H
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Mar 03, 2011
    Hi David,

    It doesn't make sense to replace any 30x redirect with a 301 as that tells the client and any intermediate web proxies to cache the response. As you said, you could try using the rewrite redirect option on the HTTP profile. Or you could adapt a or precise iRule: 

    
From: http://devcentral.f5.com/wiki/default.aspx/iRules/RewriteHTTPRedirectPort.html
when HTTP_RESPONSE {

    Check if server response is a redirect
   if { [HTTP::header is_redirect]} {

       Log original and updated values
      log local0. "Original Location header value: [HTTP::header value Location],\
         updated: [string map ":[TCP::remote_port]/ / http:// https://" [HTTP::header value Location]]"

       Do the update, replacing :8080/ with / (where 8080 is the pool member's port) and http:// with https://
      HTTP::header replace Location [string map ":[TCP::remote_port]/ / http:// https://" [HTTP::header value Location]]
   }
}

    Aaron
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Mar 03, 2011
    Sorry Hamish, I didn't see your reply.

     

     

    Aaron