For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Joe_5599_134300's avatar
Joe_5599_134300
Icon for Nimbostratus rankNimbostratus
May 03, 2016

How can you block/reject subdirectories only, with an irule?

I want to block only the subdirectory and not the default or parent.   This irule I found on Dev Central and some others I have been testing with will also apply the reject to anything before the ...
application delivery
iRules
security
Yann_Desmarest's avatar
Yann_Desmarest
Icon for Cirrus rankCirrus
May 03, 2016

Hello,

Taken into account the remarks from Vernon and your issue, why not responding with a 403 status and content instead of rejecting the connection. Rejecting the connection may impact subsequent requests when there is some pipelining features activated or if you go through a web proxy or multiple reverse proxies before reaching the bigip.

when HTTP_REQUEST { 
    switch -glob [HTTP::path] { 
        "*/appsite1" { HTTP::respond 403 content "some html content explaining that the request is not allowed" } 
    } 
}

If you have only this check to do, You may use of the "if" condition instead of switch.

  • Joe_5599_134300's avatar
    Joe_5599_134300
    Icon for Nimbostratus rankNimbostratus
    May 04, 2016
    I only want the irule to fire when it sees the /appsite1 but not when it sees the /app. www.xyz.com/app/appsite1