Forum Discussion

Eric_Weiss_2486's avatar
Eric_Weiss_2486
Icon for Nimbostratus rankNimbostratus
Feb 15, 2016

HTTP::header - match on 'Cookie' header entry

I'd like to use a rule to block client to REST server connections, as only server-to-server should be allowed for REST services. Does the following look sound? The idea is to block client connections. This would most likely still allow other client connections, such as curl, wget, etc. so I'm not sure on how to create a rule that's more broad-sweeping than this. Any suggestions would be greatly appreciated!

 

If header 'Cookie' contains ‘deviceType=desktop’, reject the connection.

when HTTP_REQUEST { if {[string match -nocase "deviceType=desktop" [HTTP::header "Cookie"]]} { reject } }

 

Thank you! Eric

 

BIG-IP
iRules
security

3 Replies

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Feb 15, 2016

    I believe the syntax might look a bit more like this:

    when HTTP_REQUEST {
    if { ( [HTTP::cookie exists deviceType] ) and ( [HTTP::cookie value deviceType] contains "desktop" ) } {
        reject
    }
}

    But then it's more accurate to say that it'll be challenging at best to absolutely prevent this, assuming that a client can modify any part of the request. The client can add/remove/modify any headers and cookies, so it's virtually impossible to secure an application using HTTP values in this way. And as long as you understand and accept this, you might just be better off limiting access by the User-Agent header, if service and browser UAs are indeed different.

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Feb 15, 2016

    Hi Eric,

    you may try the syntax below, to "soft-block" the most common Browser-based User-Agents...

    when HTTP_REQUEST {
    if { ( [HTTP::header value "User-Agent"] contains "Mozilla" ) or 
         ( [HTTP::header value "User-Agent"] contains "Opera" ) } then {
         reject
    }
}

    Note: I've to second Kevin's opinion. Using such an ACL is more or less just providing Security-by-Obscurity... 😉

    Note: Test the iRule carefully to not block legitimate API traffic. The chances are there, that a developer is using somehow a browser-based User-Agent string...

    Cheers, Kai

  • Eric_Weiss_2486's avatar
    Eric_Weiss_2486
    Icon for Nimbostratus rankNimbostratus
    Feb 15, 2016

    Thank you, Kevin and Kai! This is excellent, and precisely what I was looking for. Your cautionary info is also noted.