For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

BharatSharda's avatar
BharatSharda
Icon for Altostratus rankAltostratus
Apr 08, 2021
Solved

Insert text to HTTP header via iRule event during APM execution

Hi Community Members, We are trying to insert some text to HTTP header through an iRule which will check for ACCESS_POLICY_AGENT_EVENT generated by via iRule event during an APM checking. Event "...
application delivery
BIG-IP Access Policy Manager (APM)
iRules
  • spalande's avatar
    spalande
    Apr 14, 2021

    HTTP_REQUEST_SEND is also one of the event can be used to send the APM variable.

    https://support.f5.com/csp/article/K74392192

    so worth trying below. modify as needed.

    when ACCESS_POLICY_AGENT_EVENT {
    if { [ACCESS::policy agent_id] eq "event_1" } {
        ACCESS::session data set session.custom.header "value"
        set header [ACCESS::session data get "session.custom.header"]
    }
 }
 
 when HTTP_REQUEST_SEND  {    
    clientside {
    if {[info exists header]}{ 
	HTTP::header insert "headername" $header
    } else {
	 return
	}
   }	
 }
BharatSharda's avatar
BharatSharda
Icon for Altostratus rankAltostratus
Apr 09, 2021

Hi Nikoolayy1,

 

Thank you for your suggestion.

Our expectation is to insert the header when the flow goes through just a certain APM check (branch path) and a certain condition is met, that is because we tried to use ACCESS_POLICY_AGENT_EVENT. Header should not be added by any other APM branch.

 

If we use "ACCESS_POLICY_COMPLETED" or "HTTP_REQUEST" or "ACCESS_ACL_ALLOWED" or even "HTTP_REQUEST", header will be added for all the checks, not just by a specific APM.

spalande's avatar
spalande
Icon for Nacreous rankNacreous
Apr 13, 2021

Can you enable some logging and see what's happeing. also edit the iRule to add "insert header"

when ACCESS_POLICY_AGENT_EVENT {
    if { [ACCESS::policy agent_id] eq "event_1" } {
        ACCESS::session data set session.custom.header "value"
        set header [ACCESS::session data get "session.custom.header"]
		log local0. "header: $header"
    }
 }
 when ACCESS_POLICY_COMPLETED {
    if {[info exists header]}{
	log local0. "header found"
	HTTP::header insert "headername" $header
	log local0. "header inserted with value $header"
	} else {
	log local0. "no header added as event doesn't match"
	 return
	}
 }

"