For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jnantel's avatar
jnantel
Icon for Nimbostratus rankNimbostratus
Feb 07, 2012

http to https with ExtJS lib derived content

To give you a quick summary of my setup:     I am using F5 Bigip LTM to terminate incoming https sessions and forwarding to the webservers with http. There are 2 webservers and they both work co...
application delivery
dev
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Feb 13, 2012
The stream filter and iRule should have fairly low overhead as LTM isn't having to buffer the full payloads to do the rewriting like it would if you used HTTP::collect/HTTP::payload to rewrite the response content. You could make the iRule even more efficient by further limiting when you enable the stream filter. If the http:// reference is only sent in response content for specific response content-types, you could make the 'if {[HTTP::header value Content-Type] contains "text"' check more exact like 'if {[HTTP::header value Content-Type] starts_with "text/javascript"'. Or if the http:// reference is only sent in replies to a specific URI, you could add a check in HTTP_REQUEST based on the requested URI and only enable the stream filter in HTTP_RESPONSE for that URI.

 

 

It would be most efficient to avoid using the iRule altogether by updating the application to either use https:// in absolute references or to use relative URIs (without the protocol and host name) if possible.

 

 

Aaron