For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

bk1_144234's avatar
bk1_144234
Icon for Nimbostratus rankNimbostratus
Apr 08, 2014

Handle HTTP_RESPONSE status: 304 for static content

Hi all,

I have a question about handling http 304 responses for some static content from a server behind our BIG IP LTM 3900 with ssl offloading.

situation: client --> BIG-IP_LB (https) --> webserver_pool (http)

The client accesses a webapp via the loadbalancer using http which gets redirected to https via a basic irule.

WHEN HTTP_REQUEST {
    HTTP::REDIRECT "https://[HTTP::HOST][HTTP::uri]
}

After logging in some stylesheets/content is missing like css/js/image/png/jpg files. When troubleshooting i notice that the server/loadbalancer returns a 304 on this content with no-cache headers. I tried to work around this by attempting to rewrite the response codes from 304 to 200, experimented by using http profiles with ram cache, tried to modify the no-cache header but none off these options seem to work. I assume there must be a easy way to get around this. When using plain http via the LB everything works fine. Any idea how to fix this?

LTM log: Apr 8 13:12:57 local/tmm1 info tmm1[4972]: Rule tshoot-log : Virtual: VAppServer_443, Client 192.168.1.191:65068 -> webapp.company.local/one/themes/style.css -> (response) - status: 304 Apr 8 13:12:57 local/tmm1 info tmm1[4972]: Rule tshoot-log : Server: Apache-Coyote/1.1 Apr 8 13:12:57 local/tmm1 info tmm1[4972]: Rule tshoot-log : Pragma: No-cache Apr 8 13:12:57 local/tmm1 info tmm1[4972]: Rule tshoot-log : Cache-Control: no-cache Apr 8 13:12:57 local/tmm1 info tmm1[4972]: Rule tshoot-log : Expires: Fri, 01 Jan 1970 01:00:00 CST Apr 8 13:12:57 local/tmm1 info tmm1[4972]: Rule tshoot-log : P3P: CP="ALL" Apr 8 13:12:57 local/tmm1 info tmm1[4972]: Rule tshoot-log : ETag: W/"1015-1288336220000" Apr 8 13:12:57 local/tmm1 info tmm1[4972]: Rule tshoot-log : Date: Tue, 08 Apr 2014 11:12:53 CST Apr 8 13:12:57 local/tmm1 info tmm1[4972]: Rule tshoot-log : Connection: keep-alive

application delivery
BIG-IP Access Policy Manager (APM)
devops
iRules
LTM
management
performance
security

3 Replies

  • IheartF5_45022's avatar
    IheartF5_45022
    Icon for Nacreous rankNacreous
    Apr 09, 2014

    If the client made a conditional request then why is a 304 not OK?

    when HTTP_RESPONSE {
    if {[HTTP::status] == 304 } {
         Remove Cache-Control
        HTTP::header remove Cache-Control
    }
}
  • bk1_144234's avatar
    bk1_144234
    Icon for Nimbostratus rankNimbostratus
    Apr 09, 2014

    In itself there's nothing wrong with a 304 reponse, the fact is the page layout which is incorrectly presented at the clients webbrowser. (Static) content files like .css, .js, .png are not displayed which malforms the web applicaton. Probably it's related to the configuration of the back-end webserver which hosts the application but it is out of my control so i hope to 'fix' this on the BIG-IP. I'll let you know if the irule does the trick.

     

  • bk1_144234's avatar
    bk1_144234
    Icon for Nimbostratus rankNimbostratus
    Apr 10, 2014

    FYI the problem was related to some ajax calls which went to http instead of https. After some troubleshooting it appears that the tomcat server.xml needs modification by appending the following parameter to the default connector-port 

    proxyPort="443" scheme="https" secure="true"

    I think it can also be done by a http profile but anyway, this works for me :-). Thanks for your help!