Forum Discussion
Arthur_7109
Nimbostratus
NimbostratusHTTP::header insert does not work in ASM_REQUEST_VIOLATION?
Hi guys,
This is just in a test environment, and I don't want to open a case with F5.
We have BIG-IP 10.2.1 Build 296.0 Final and it may be limited to this release.
We have these irules
when ASM_REQUEST_VIOLATION {
HTTP::header insert "X-CSRF-VIOLATION" "Smurf"
log local0. "ASM_REQUEST_VIOLATION on [HTTP::uri]"
log local0. "Header value is [HTTP::header X-CSRF-VIOLATION]"
}
when HTTP_RESPONSE {
log local0. "Header value is [HTTP::header X-CSRF-VIOLATION]"
}
and the syslogs are
Jan 25 15:27:07 local/tmm info tmm[4918]: Rule ir_test_CSRF < ASM_REQUEST_VIOLATION >: ASM_REQUEST_VIOLATION on /portal/contactblock.asp?module=pcbbinfo
Jan 25 15:27:07 local/tmm info tmm[4918]: Rule ir_test_CSRF < ASM_REQUEST_VIOLATION >: Header value is Smurf
Jan 25 15:27:07 local/tmm info tmm[4918]: Rule ir_test_CSRF < HTTP_RESPONSE >: Header value is
It appears that the new header is not inserted (and it is not seen in the browser either).
So it looks like the "HTTP::header insert" in ASM_REQUEST_VIOLATION does not "stick"?
Arthur
hooleylistCirrostratus
Hi Arthur,
ASM_REQUEST_VIOLATION is triggered when ASM validates the request. If you insert a header in that event it will be done in the request proxied to the server. The server wouldn't include the header in its response so you wouldn't see the header in HTTP_RESPONSE.
If you want the header inserted in the response so the client sees it, can you try this? If you want to save the output from a command in ASM_REQUEST_VIOLATION, you could do that too and reference it in HTTP_RESPONSE.when HTTP_REQUEST { set insert_header 0 } when ASM_REQUEST_VIOLATION { set insert_header 1 } when HTTP_RESPONSE { if {$insert_header}{ HTTP::header insert "X-CSRF-VIOLATION" "Smurf" log local0. "ASM_REQUEST_VIOLATION on [HTTP::uri]" log local0. "Header value is [HTTP::header X-CSRF-VIOLATION]" } }
Or if the check / full policy is in blocking mode, you'd use ASM_REQUEST_BLOCKING:
http://devcentral.f5.com/wiki/iRules.asm.ashx
Aaron
Arthur_7109Thanks Aaron, of course :-) that make sense.
It's working OK now (I had to move log local0. "ASM_REQUEST_VIOLATION on [HTTP::uri]" as HTTP::uri is not available in HTTP_RESPONSE).
Arthur- hooleylistYeah, [HTTP::uri] isn't saved automatically after the request is sent to the pool. If you did want to log the value in HTTP_RESPONSE, you could save the value to a variable in HTTP_REQUEST.
Aaron