How to replace only second instance of header?

Question

I'm trying to write a rule that will take an HTTP request that contains two "X-Forwarded-For" headers and rename only the second one.  Is there any way to accomplish this in v9.1.2?  I can get it done with "HTTP::header values", but v9.4 is not an option for these devices right now.

danielseyoum · Answer

Try the getfield command: 
&nbsp;getfield   
&nbsp;I am not sure of the separator of the host header string (replace ":" with the appropriate separator) and use 2 for the field_number&nbsp;
&nbsp;when HTTP_REQUEST {
&nbsp;  [getfield [HTTP::header] ":" 2]
&nbsp;}&nbsp;

erick_hammersm1 · Answer

Thanks for the replies.  Unfortunately, [HTTP::header] isn't valid syntax.  You have to pass it the name of the header you want to process, and it only ever returns the first header with that name (this was resolved in v9.4 with "HTTP::header values", which returns all values for a header).  If I was using v9.2, I could use "HTTP::request" to get the whole request and parse out the headers I'm looking for, but I need a solution for v9.1.2.
Fortunately, I was able to attack my problem from another angle.  The initial problem statement was "modify a request's second X-Forwarded-For" header, but it turned out that the last X-Forwarded-For header was being inserted by the BIG-IP's HTTP profile.  Turning off the X-Forwarded-For functionality in the profile let me add smarter functionality in the rule:when HTTP_REQUEST {
  if { [HTTP::header exists X-Forwarded-For] } {
    HTTP::header insert Akamai-Peer-IP [IP::remote_addr]
  } else {
    HTTP::header insert X-Forwarded-For [IP::remote_addr]
  }
}

Forum Discussion

How to replace only second instance of header?

2 Replies

AppWorld Berlin iRules Contest!

F5 AppWorld 2026 Las Vegas - iRules Contest Winners!

Recent Discussions

How to Verify config before loading to F5

VIP control across data centers - how to ensure only 1 VIP is up at a time?

FQDN Node Configuration

Limit connection per VS and redirect user

APM and Datasafe