For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

kamlyada_209668's avatar
kamlyada_209668
Icon for Nimbostratus rankNimbostratus
May 04, 2016

All urls which are not like _https://uat.kamlesh.com/alfresco/api should not work

Hello, We have created VIp for url - https://uat.kamlesh.com/alfresco/api/ and client wants that he must be able to reach this url -https://uat.kamlesh.com/alfresco/api/ and if anyone trying to access with anything else must be rejected.

 

In fact all urls which are not like _https://uat.kamlesh.com/alfresco/api should not work.I need IRULE for the same. Please anyone could help in this.It would be very helpful.Thanks in advance.

 

Regards Kamlesh Y

 

LTM
security

3 Replies

  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    May 04, 2016

    if I understand you want to create a whitelist, to allow just a specific URL. If it is the cas this irule can help you:

     

    when HTTP_REQUEST {

     

    set uri [string tolower [HTTP::uri]]

     

    if { $uri equals "/alfresco/api/ || $uri equals "/alfresco/api" }{

     

    log loca0. "allow access"

     

    } else {

     

    log loca0. "Access denied for the following uri: $uri"

     

    reject

     

    }

     

    }

     

    Regards

     

  • Yann_Desmarest's avatar
    Yann_Desmarest
    Icon for Cirrus rankCirrus
    May 04, 2016

    Hello,

    Try this one : 

    when HTTP_REQUEST {
  if { ! ([HTTP::host] equals "uat.kamlesh.com" and [HTTP::path] starts_with "/alfresco/api") } {
    reject
     alternative : HTTP::respond 403 content "request not authorized"
  }
}
  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    May 04, 2016

    corrected and functional irule:

    when HTTP_REQUEST {

    set uri [string tolower [HTTP::uri]]

    if { $uri equals "/alfresco/api/" || $uri equals "/alfresco/api" } {

    log local0. "allow access"

    } else {

    log local0. "Access denied for the following uri: $uri"

reject

    }

    }