Forum Discussion

Stefano_it_2554's avatar
Stefano_it_2554
Icon for Nimbostratus rankNimbostratus
Feb 08, 2017

APM - Keep alive a session given a sid

Hi, I'm writing a iRule for keep alive the session with sid read from http header.

How can I refresh the session ttl with inactivity timeout value of access profile?

 

when HTTP_REQUEST {
    set sidToRefresh [HTTP::header value sid]
    log local0. "sid To Refresh:$sidToRefresh"
    if { [ACCESS::session exists -sid $sidToRefresh] } {
         keep alive the session "sidToRefresh"
    } 
}

 

Can anyone help me? Thanks

 

access session
application delivery
BIG-IP Access Policy Manager (APM)
devops
iRules
  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Feb 08, 2017

    Hi Stefano,

    unfortunately you can't reset the inactivity timeout for a given user session via the various [ACCESS::*] commands. You have to pass the APM filter using a valid MRHSession=SID cookie to reset the inactivity timer.

    Depending on your detailed usecase, you could try to impersonate the ongoing HTTP request containing the provided [HTTP::header value sid] value and then request either a 1x1.gif on the backend systems or even a specific code block within the ACCESS_ACL_ALLOWED event. Check out the iRule below to get some ideas...

     

    when HTTP_REQUEST {
    set sidToRefresh [HTTP::header value sid]
    if { $sidToRefresh ne "" } then {
        if { [ACCESS::session exists -state_allow -sid $sidToRefresh] } then {
            HTTP::cookie remove MRHSession
            HTTP::cookie insert name MRHSession value $sidToRefresh
            set reset_timeout 1
        } else {
            HTTP::respond 200 content "The requested SID \"$sidToRefresh\" does not exists or is already inactive"
        }
    } else {
         The request does not contain a SID header.
    }
}
when ACCESS_ACL_ALLOWED {
    if { [info exists reset_timeout] } then {
        ACCESS::respond 200 content "Successfully reset the timeout timer for SID \"$sidToRefresh\""
        unset -nocomplain reset_timeout
    }
}

     

    Note: If the solution above doesn't fit into your usecase, then please explain a little bit more what you're trying to accomplish.

    Cheers, Kai