Forum Discussion
Chen_Zhe
Altostratus
Altostratusbase on HTTP header irules to blocked request
Hi, Demand background： Each request must contain at least one of the four header （has configed at Application Security : Headers : HTTP Headers） access-token authentication authorization ...
Ivan_Chernenkii
Employee
EmployeeHello Chen Zhe,
What are you trying to achieve? If you want to block all requests which don't contains any of these 4 headers, then it would be better just create such rule in iRule or you can create attack signature with such rule (e.g content:!"access-token"; nocase; content:!"authentication"; nocase;....)
Thanks, Ivan
Chen_ZheHi Ivan,
thank you!
Achieve you guess is right,detail: block all request which don't contains any of these 4 headers,unless shome HOST or host+uri .
but,rules didn't work as I expected。
when hit whilelist fist,at the end rules it hit discard again.
when HTTP_REQUEST {
if {[HTTP::header exists token] or [HTTP::header exists access-token] or [HTTP::header exists authentication] or [HTTP::header exists authorization]}{
ASM::enable "/Common/base-on-header-string"
}
#following all fuction is whitelist.
if { [class match [HTTP::host] contains domain_whiltlist] } {
ASM::enable "/Common/base-on-header-string"
}
if { [HTTP::host] == "meetingroomip-uat.bba-app.com" || [HTTP::host] == "meeting-inspection.bba-app.biz" } {
if {[class match [HTTP::uri] contains meeting] } {
ASM::enable "/Common/base-on-header-string"
}
}
if { [HTTP::host] == "bestyou-uat.bba-app.com" || [HTTP::host] == "bestyou.bba-app.biz" } {
if { [class match [HTTP::uri] contains bestyou] } {
ASM::enable "/Common/base-on-header-string"
}
}
else{
discard
}
- Ivan_Chernenkii
I didn't get your further "whitelist" part...
Do you want not enforce in case of whitelist?.. then you need ASM: disable.
Also, you have
when HTTP_REQUEST {
if {[HTTP::header exists token] or [HTTP::header exists access-token] or [HTTP::header exists authentication] or [HTTP::header exists authorization]}{
ASM::enable "/Common/base-on-header-string"
}
which means apply ASM policy in case of at least one header exists... While AFAIU you didn't want to block it. Please, clarify.
- Chen_Zhe
thank you for your reply, forgot it.
I changed irules to meet the requirements, but I encountered problems related to if, elseif, else. and i asked new question.