For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Pytonius's avatar
Pytonius
Icon for Nimbostratus rankNimbostratus
Nov 10, 2025
Solved

APM HTTP Connector request and HTTP Headers

Hello, 

can someone share working solution for populating variables, used to send APM HTTP connector auth request, from HTTP headers?

User (API) sends credentials in HTTP headers X-LOGIN and X-TOKEN.

I tried to assign variables directly in per request policy, but this is not supported. I also tried to assign them using iRule:

when HTTP_REQUEST {
    set loginvalue [HTTP::header "X-LOGIN"]
    set tokenvalue [HTTP::header "X-TOKEN"]
    log local0. "Assigned variables are: LOGIN:$loginvalue TOKEN:$tokenvalue"
}

cURL request:

curl 1.2.3.4 --header "X-LOGIN: James" --header "X-TOKEN: Brown" --header "clientless-mode: 1"

 

Local traffic log shows correct assignment:

Rule /Common/headers_variables <HTTP_REQUEST>: Assigned variables are: LOGIN:James TOKEN:Brown

 

Direct using variables loginvalue and tokenvalue in HTTP connector request is not working, so I also tried to map them in PRP "Variable assign" block:
session.custom.login = Session Variable loginvalue 
session.custom.token= Session Variable tokenvalue 

 

But HTTP connector auth request
http://www.auth.com/api/v1/auth?login=%{session.custom.login}&token=%{session.custom.token}
is always empty, as seen from tcpdump capture:

[Full request URI: http://www.auth.com/api/v1/auth?login=&token=]

 

Any ideas please?

  • Hello Pytonius​ 

    setting custom variables in per request policy is not as easy as in a per session policy
    you can only set perflow.scratchpad and perflow.custom
    check this

    https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-per-request-policies/using-step-up-authentication/concepts-to-know-for-building-step-up-authentication.html

     

2 Replies

  • Hello Pytonius​ 

    setting custom variables in per request policy is not as easy as in a per session policy
    you can only set perflow.scratchpad and perflow.custom
    check this

    https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-per-request-policies/using-step-up-authentication/concepts-to-know-for-building-step-up-authentication.html

     

  • It works, thank you for pointing me the right direction! Even F5 support did not mentioned this limitation. 

    If someone needs more details, here is similar scenario:

    https://docs.corsha.com/integrations/f5/