For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

swo0sh_gt_13163's avatar
swo0sh_gt_13163
Icon for Altostratus rankAltostratus
Aug 13, 2014

How to escape special characters from query string?

Hello Folks,

 

I hope you are rocking and chilling out there. I need some help in order to escape special characters from the query string. What happens exactly is, a service supplying credentials to a middle-ware server for authentication, and this communication passes through F5 VIP (APM enabled).

 

The issue happens is, the query string truncates the character from the query string, and this special character is part of the password, so cannot request user to not use such character :P

 

For better clarification, please refer the following URL, where I have published the capture of wireshark log. https://cloud.helpag.com/public.php?service=files&t=be592319d325436b57c76f79005ecbde

 

Kindly help me to manage this.

 

Thank you, Darshan

 

7 Replies

  • Try URL encoding the query string before sending downstream;-

    when HTTP_REQUEST {
        HTTP::uri "[HTTP::path]?[URI::encode [URI::query [HTTP::uri]]]"
    }
    
  • Thanks,

     

    A small concern, since we are trying to encode the query string, and special character is being used within password parameter, do you think encoded string wouldn't be considered as an ACTUAL password?

     

    Sorry, I don't understand code, it might look dumb to ask.

     

    Cheers!

     

  • I am making an assumption (possibly incorrect) that the backend system that needs to use the password will perform URI::decode - it's worth a try.

     

    What system is it that 'loses' the '' ? APM?

     

    I've looked at your screenshot - do you even need the query string? Won't the system use the Authorization header if there is no query string?

     

  • I think no, the system refers the URI to extract the credentials out. I hope I understood the question correctly.

     

  • Sounds odd - not sure what the point of the Auth header is.

     

    Are you sure the client system is even sending the in the query string? Perhaps it's a client error? If you are sure - where is the going missing? Is it there when the request hits the F5?

     

  • Hmm.... Honestly I am not sure what is being supplied by client, as the capture taken between F5 and backend server.

     

    However the backend server should refer the auth header as you have mentioned, rather looking into HTTP query string. If that is the case, then the iRule would help resolving the issue.

     

    I will share my latest observation very soon.

     

    Thank you very much for your help. Darshan