Forum Discussion

Arthur_7109's avatar
Arthur_7109
Icon for Nimbostratus rankNimbostratus
Jan 25, 2012

HTTP::header insert does not work in ASM_REQUEST_VIOLATION?

Hi guys,

 

 

This is just in a test environment, and I don't want to open a case with F5.

 

 

We have BIG-IP 10.2.1 Build 296.0 Final and it may be limited to this release.

 

 

We have these irules

 

 

when ASM_REQUEST_VIOLATION {

 

HTTP::header insert "X-CSRF-VIOLATION" "Smurf"

 

log local0. "ASM_REQUEST_VIOLATION on [HTTP::uri]"

 

log local0. "Header value is [HTTP::header X-CSRF-VIOLATION]"

 

}

 

 

when HTTP_RESPONSE {

 

log local0. "Header value is [HTTP::header X-CSRF-VIOLATION]"

 

}

 

 

and the syslogs are

 

 

Jan 25 15:27:07 local/tmm info tmm[4918]: Rule ir_test_CSRF < ASM_REQUEST_VIOLATION >: ASM_REQUEST_VIOLATION on /portal/contactblock.asp?module=pcbbinfo

 

Jan 25 15:27:07 local/tmm info tmm[4918]: Rule ir_test_CSRF < ASM_REQUEST_VIOLATION >: Header value is Smurf

 

Jan 25 15:27:07 local/tmm info tmm[4918]: Rule ir_test_CSRF < HTTP_RESPONSE >: Header value is

 

 

It appears that the new header is not inserted (and it is not seen in the browser either).

 

 

So it looks like the "HTTP::header insert" in ASM_REQUEST_VIOLATION does not "stick"?

 

 

Arthur

 

 

 

 

 

application delivery
dev
devops
iRules
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jan 25, 2012
    Hi Arthur,

    ASM_REQUEST_VIOLATION is triggered when ASM validates the request. If you insert a header in that event it will be done in the request proxied to the server. The server wouldn't include the header in its response so you wouldn't see the header in HTTP_RESPONSE.

    If you want the header inserted in the response so the client sees it, can you try this? If you want to save the output from a command in ASM_REQUEST_VIOLATION, you could do that too and reference it in HTTP_RESPONSE. 

    
when HTTP_REQUEST {
set insert_header 0
}
when ASM_REQUEST_VIOLATION {
set insert_header 1
}
when HTTP_RESPONSE {
if {$insert_header}{
HTTP::header insert "X-CSRF-VIOLATION" "Smurf"
log local0. "ASM_REQUEST_VIOLATION on [HTTP::uri]"
log local0. "Header value is [HTTP::header X-CSRF-VIOLATION]"
}
}

    Or if the check / full policy is in blocking mode, you'd use ASM_REQUEST_BLOCKING:

    http://devcentral.f5.com/wiki/iRules.asm.ashx

    Aaron
  • Arthur_7109's avatar
    Arthur_7109
    Icon for Nimbostratus rankNimbostratus
    Jan 26, 2012
    Thanks Aaron, of course :-) that make sense.

     

     

    It's working OK now (I had to move log local0. "ASM_REQUEST_VIOLATION on [HTTP::uri]" as HTTP::uri is not available in HTTP_RESPONSE).

     

     

    Arthur
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jan 26, 2012
    Yeah, [HTTP::uri] isn't saved automatically after the request is sent to the pool. If you did want to log the value in HTTP_RESPONSE, you could save the value to a variable in HTTP_REQUEST.

     

     

    Aaron