How can you block/reject subdirectories only, with an irule?

Hello,

This irule should works for you :

when HTTP_REQUEST { 
    switch -glob [string tolower [HTTP::path]] { 
        "*/appsite1" { reject } 
        default {  do nothing } 
    } 
}

Hello,

This irule should works for you :

when HTTP_REQUEST { 
    switch -glob [string tolower [HTTP::path]] { 
        "*/appsite1" { reject } 
        default {  do nothing } 
    } 
}

@Yann's use of the

switch

string tolower

When a URI uses components of the generic syntax, the component
syntax equivalence rules always apply; namely, that the scheme and
host are case-insensitive and therefore should be normalized to
lowercase.  For example, the URI  is
equivalent to .  The other generic syntax
components are assumed to be case-sensitive unless specifically
defined otherwise by the scheme (see Section 6.2.3).

So, unless the filesystem is case-insensitive or the HTTP server provides virtual paths that it handles in a case-insensitive fashion, the

string tolower

I mention this here only because I very often see this pattern. For matching against, say,

HTTP::host

HTTP::path

Secondly, the

default

switch

Hello,

Taken into account the remarks from Vernon and your issue, why not responding with a 403 status and content instead of rejecting the connection. Rejecting the connection may impact subsequent requests when there is some pipelining features activated or if you go through a web proxy or multiple reverse proxies before reaching the bigip.

when HTTP_REQUEST { 
    switch -glob [HTTP::path] { 
        "*/appsite1" { HTTP::respond 403 content "some html content explaining that the request is not allowed" } 
    } 
}

If you have only this check to do, You may use of the "if" condition instead of switch.

Hello,

Taken into account the remarks from Vernon and your issue, why not responding with a 403 status and content instead of rejecting the connection. Rejecting the connection may impact subsequent requests when there is some pipelining features activated or if you go through a web proxy or multiple reverse proxies before reaching the bigip.

when HTTP_REQUEST { 
    switch -glob [HTTP::path] { 
        "*/appsite1" { HTTP::respond 403 content "some html content explaining that the request is not allowed" } 
    } 
}

If you have only this check to do, You may use of the "if" condition instead of switch.

Hello,

Ok, you just need to replace "*/appsite1" by "/appsite1" to make it works your way.

when HTTP_REQUEST { 
    switch -glob [HTTP::path] { 
        "/appsite1" { HTTP::respond 403 content "some html content explaining that the request is not allowed" } 
    } 
}

and if you don't plan to add exceptions, you can use a simple if condition

when HTTP_REQUEST { 
    if { [HTTP::path] equals "/appsite1" } { 
        HTTP::respond 403 content "some html content explaining that the request is not allowed"
    } 
}

Hello,

Ok, you just need to replace "*/appsite1" by "/appsite1" to make it works your way.

when HTTP_REQUEST { 
    switch -glob [HTTP::path] { 
        "/appsite1" { HTTP::respond 403 content "some html content explaining that the request is not allowed" } 
    } 
}

and if you don't plan to add exceptions, you can use a simple if condition

when HTTP_REQUEST { 
    if { [HTTP::path] equals "/appsite1" } { 
        HTTP::respond 403 content "some html content explaining that the request is not allowed"
    } 
}

when HTTP_REQUEST { 
    if { [HTTP::path] equals "/app/appsite1" } { 
        HTTP::respond 403 content "some html content explaining that the request is not allowed"
    } 
}

Hi,

if you want to block all sub-directory, you can use irule provided by Yann, but with

starts_with

equals

when HTTP_REQUEST { 
    if { [HTTP::path] starts_with "/app/appsite1" } { 
        HTTP::respond 403 content "some html content explaining that the request is not allowed"
    } 
}