For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

sbadea_81872's avatar
sbadea_81872
Icon for Nimbostratus rankNimbostratus
May 01, 2009

irule for allowing mixed content

One of our websites protected by SSL (SSL certificate is installed on our BIG-IP LTM ) contains reference links (pictures, menu bars)to http.

 

When someone is hitting the web site using IE8, http gets redirected to https (I have an irule for that) but is getting a warning message "do you want to view only the webpage content that was delivered securely?"

 

Is it any way to create an irule to allow mixed content so the browser would not show the warning?

 

 

The irule I use for http redirection is:

 

 

when HTTP_REQUEST {

 

HTTP::redirect https://[HTTP::host][HTTP::uri]

 

}

 

 

Thank you all for help

 

 

Sorin
application delivery
dev
devops
iRules

4 Replies

  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    May 02, 2009
    Hi Sorin,

     

    I haven't found any way on an iRule - more or less I fixed the mixed content that was being displayed OR adjusted my browser not to warn me about mixed content.

     

     

    CB

     

  • sbadea_81872's avatar
    sbadea_81872
    Icon for Nimbostratus rankNimbostratus
    May 04, 2009
    Adjusting the browser was not an option. I have found a solution by using a customized stream profile. Read this solution posted on support web site

     

    https://support.f5.com/kb/en-us/solutions/public/8000/100/sol8115.html

     

     

    Thanks, S.
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    May 05, 2009
    Hi Sorin,

    Make sure to explicitly disable the stream filter if the response type isn't text. This is something that SOL8115 doesn't show, but should. 

     
 when HTTP_RESPONSE { 
    if { [HTTP::header Content-Type] starts_with "text/" }{ 
       STREAM::expression "@abc@123@" 
       STREAM::enable 
    } else { 
       STREAM::disable 
    } 
 }

    Also, if the string you're replacing is a different length than the replacement string, you'll need to create a custom HTTP profile with response chunking set to rechunk. This gets around a mismatch in content length as chunked responses don't use a content length header.

    Aaron