Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

eric_haupt1's avatar
eric_haupt1
Icon for Nimbostratus rankNimbostratus
Apr 01, 2019

Checking for APM variable existence

I need a conditional action to populate some APM variables into headers. These variables are going to be client-ip, Cert Issuer, Cert Subject, F5-Session ID,F5-Session start time, Cert email. If the ...
application delivery
BIG-IP Access Policy Manager (APM)
LTM
eric_haupt1's avatar
eric_haupt1
Icon for Nimbostratus rankNimbostratus
Apr 01, 2019

Ok... I think this is it. 

when ACCESS_ACL_ALLOWED {
            set var_issuer [ACCESS::session data get session.ssl.cert.issuer]
            set var_subject [ACCESS::session data get session.ssl.cert.subject]
            set var_upn [ACCESS::session data get session.custom.cert.upn]
            set var_email [ACCESS::session data get session.custom.cert.email]

            HTTP::header insert "X-F5-Forwarded-For" [IP::client_addr]
            log local0. "X-F5-Forwarded-For [IP::client_addr]"

            HTTP::header insert "X-F5-Session-ID" [ACCESS::session sid]
            log local0. "X-F5-Session-ID [ACCESS::session sid]"

            HTTP::header insert "X-F5-Session-Start" [ACCESS::session data get session.custom.start.time]
            log local0. "X-F5-Session-Start [ACCESS::session data get session.custom.start.time]"

            if { [info exists var_issuer] && ($var_issuer ne "") } {
                    HTTP::header insert "X-F5-Cert-Issuer" [ACCESS::session data get session.ssl.cert.issuer]
                    log local0. "X-F5-Cert-Issuer [ACCESS::session data get session.ssl.cert.issuer]" }
                    else { return }

            if { [info exists var_subject] && ($var_subject ne "") } {
                    HTTP::header insert "X-F5-Cert-Subject" [ACCESS::session data get session.ssl.cert.subject]
                    log local0. "X-F5-Cert-Subject [ACCESS::session data get session.ssl.cert.subject]" }
                    else { return }

            if { [info exists var_upn] && ($var_upn ne "") } {
                    HTTP::header insert "X-F5-Cert-UPN" [ACCESS::session data get session.custom.cert.upn]
                    log local0. "X-F5-Cert-UPN [ACCESS::session data get session.custom.cert.upn]" }
                    else { return }

            if { [info exists var_email] && ($var_email ne "") } {
                    HTTP::header insert "X-F5-Cert-Email" [ACCESS::session data get session.custom.cert.email]
                    log local0. "X-F5-Cert-Email [ACCESS::session data get session.custom.cert.email]" }
                    else { return }
}