i-Rule to change http header

There a a few different ways to replace one string with another. You can use string map (Click here) with the format (where all variables are strings):

set $my_val [string map { $original $replacement } $content_to_search

Here is one method to replace http with https in a header called my_header:

when HTTP_REQUEST {
   if { [HTTP::header exists my_header] }{
       save current value for my_header
      set my_val [HTTP::header value my_header]
       log current value
      log local0. "my_val: $my_val"
       replace all instances of http with https in the string
      set my_new_val [string map { http https } $my_val]
       log updated value
      log local0. "my_new_val: $my_new_val"
       replace the value of my_header with the updated string
      HTTP::header replace my_header $my_new_val
       log updated header value
      log local0. "replaced header value: [HTTP::header value my_header]"
   }
}

Result:

Aug 11 08:07:26 tmm tmm[1222]: Rule string_replace_rule : my_val: http://test.com

Aug 11 08:07:26 tmm tmm[1222]: Rule string_replace_rule : my_new_val: https://test.com

Aug 11 08:07:26 tmm tmm[1222]: Rule string_replace_rule : replaced header value: https://test.com

Or with fewer variables and no logging:

when HTTP_REQUEST {
   if { [HTTP::header exists my_header] }{
      HTTP::header replace my_header [string map { http https } [HTTP::header value my_header]]
   }
}

You could also use one of the other TCL string commands to do this replacement (Click here).

Aaron

A couple of other small things...

 

 

You might want to add another check on the if statement to look for the string you want to replace in the header before you try to replace it:

 

 

if { [HTTP::header exists my_header] && [HTTP::header value my_header] contains "http%3A%2F%2Fqptlgrp%"}{

 

 

Also, once you confirm your rule is working, you should disable any unnecessary logging.

 

 

Let us know how the testing goes.

 

 

Aaron

 

Great! Everything is working perfectly now...Thanks a lot.