Forum Discussion

JRichards_45544's avatar
JRichards_45544
Icon for Nimbostratus rankNimbostratus
Nov 04, 2008

HTTPS Redirect based on http_response

New to IRules and just trying to wrap my head around some of the logic here....

 

 

I am looking to capture non-secure login pages and automatically redirect the user to make an https request back to the same page. I am looking for a way to detect that a password field is about to be passed back to the user on an unsecure connection. The SSL termination is on the F5 and the request to the backend servers are unencrypted. Unfortunately this is old web code and these pages are spread throughout the environment. I am looking for a temporary fix until the code can be fixed.

 

 

I know how to create a redirect and I have the regular expression I can use to detect the password field.

 

I need help with two things. How do I detect whether the user is connected via SSL and how do I detect the password field using a regular expression looking at the http_response so I can force a redirect?

 

 

Thanks
application delivery
dev
devops
iRules
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Nov 05, 2008
    What did you end up with? I was going to suggest redirecting all http requests to https, as it simplifies the configuration and is more secure. The other option would probably require collecting the response content and rewriting the form action to an https URL. Depending on how the application lists the form action, this could actually be fairly complicated.

     

     

    Aaron