For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

laurent_marion_'s avatar
laurent_marion_
Icon for Nimbostratus rankNimbostratus
Jan 27, 2006

https, http redirect tips & tricks

Hi,

 

 

i worked with irule and i have a small problem:

 

 

 

i have an internet website in https and http

 

my browser go to http://www.mywebip.com/

 

 

i want to follow this way:

 

if i connect to http://www.mywebip.com/ i redirect to https://www.webip.com/login

 

 

If i am on https://www.webip.com

 

i don't want to leave websecure server for all uri /login and /secure

 

but i ask another uri , i want to return in http mode.

 

 

My problem is the following:

 

when i connect http, i go to https, all is ok, but when https redirect to http, my website send me http://www.webip.com and i have a loop.

 

 

What can i do to avoid that?

 

 

I have a irule for http and a irule for https

 

my http irule is :

 

when HTTP_REQUEST {

 

if { [HTTP::uri] equals "/" }{

 

HTTP::redirect "https://www.webip.com"}

 

 

my https irules is:

 

when HTTP_REQUEST {

 

if { [HTTP::uri] starts_with "/login" } {

 

log "blahblah"

 

} elseif { [HTTP::uri] starts_with "/secure" } {

 

log "blahblah2"

 

} else {

 

HTTP::redirect "http://www.webip.com[HTTP::uri]" }

 

}

 

 

i am sure it's very easy, but i am starting with irule...

 

 

 

Thanks

 

 

 

 

 

 

 

 

 

 

application delivery
dev
devops
iRules

7 Replies

  • Colin_Walker_12's avatar
    Colin_Walker_12
    Historic F5 Account
    Jan 30, 2006
    Well, it sounds like all you'd need to do to stop the redirect loop is add the proper check to your HTTP rule.

    Assuming you only want the HTTP rule to redirect to HTTPS if they are trying to view a page inside of /secure or /login, then you'd do something like this:

    
when HTTP_REQUEST {
  if { [HTTP::uri] equals "/" } { 
    HTTP::redirect "https://www.webip.com/login"
  } elseif { ( [HTTP::uri] starts_with "/login") or ( [HTTP::uri] starts_with "/secure") } {
    HTTP::redirect "https://www.webip.com[HTTP::uri]"
  }
}

    You'd then want to change your HTTPS rule to look something like:

    
when HTTP_REQUEST {
  if { [HTTP::uri] starts_with "/login" } {
    log "blahblah"
  } elseif { [HTTP::uri] starts_with "/secure" } {
    log "blahblah2"
  } elseif { ( [HTTP::uri] equals "" ) or ( [HTTP::uri] equals "/") } {
    log "blahblah3"
  } else {
    HTTP::redirect "http://www.webip.com[HTTP::uri]" 
  }
}

    I think that should get you where you need to go. The biggest change is making sure that your HTTPS rule is checking for an empty URI, and not redirecting if the URI is empty.

    HTH,

    -Colin
  • zafer's avatar
    zafer
    Icon for Nimbostratus rankNimbostratus
    Jun 08, 2009
    Hello

     

     

    i used these irule, redirect works for http to https and https to http but i have problem with warnings

     

     

    when client request redirect http to https or https to http we receive alot of security warning messages, we wait only 1 warning message. What can i do for solving this problem

     

     

    regards

     

     

    zafer

     

  • iku_72301's avatar
    iku_72301
    Icon for Nimbostratus rankNimbostratus
    Jul 03, 2009
    hi, berberz

     

    I had the same problem before. in my case, I checked source file onf the contents. then, I tound URL were still "http://..". when I fixed these URLs, problems get solved. if you still had this problem, try it.

     

    thnx

     

    pineda
  • F5_LB_Eng's avatar
    F5_LB_Eng
    Icon for Cirrostratus rankCirrostratus
    Jul 28, 2009
    Hi All,

     

     

    I want to redirect http to https and https to https.

     

     

    for exam http://prasanna.f5.com to https://prasanna.dev.f5.com , https://prasanna.f5.com to https://prasanna.dev.f5.com

     

     

    i write the irule like below.

     

     

    when HTTP_REQUEST {

     

    if { ([HTTP::host] equals "prasanna.f5.com") } {

     

    HTTP::respond 301 Location "https://prasanna.dev.f5.com[HTTP::uri]"

     

    }

     

    else {

     

    HTTP::respond 301 Location https://[getfield [HTTP::host] ":" 1][HTTP::uri]

     

    }

     

    }

     

     

    but the customer want now

     

     

    http://*/* -> https://prasanna.dev.f5.com/*

     

    https://*/* -> https://prasanna.dev.f5.com/*

     

     

    can you please help me on this irule.

     

     

    Regards

     

    Prasanna AR
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jul 28, 2009
    Hi Prasanna,

     

     

    Check your first post for a response:

     

     

    http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&postid=34844&view=topic