For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Dave_21507's avatar
Dave_21507
Icon for Nimbostratus rankNimbostratus
Oct 01, 2009

HTTP::uri starts_with - how to make it case insensitive?

Hello everyone,   I have the following iRule in place and it works great, but discovered that a "workaround" is using onlineusers.aspx or any other combination of case (e.g., OnLineUSerS.ASPx w...
application delivery
dev
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Oct 01, 2009
There is an issue with this in that someone could make a request to /doesnt_exist/../allowed_uri/whatever and that would bypass your rule logic and go to the default pool. The webserver would normalise the requested URI to /allowed_uri.

 

 

You can check a recent post for more discussions on this:

 

http://devcentral.f5.com/Default.aspx?tabid=53&view=topic&postid=30900&ptarget=30901

 

 

Aaron