Forum Discussion

NickAD's avatar
NickAD
Icon for Cirrus rankCirrus
Apr 13, 2017

iRule for blocking specific string in header & displaying blocking page

I am wondering if I can create an iRule to block a request if a certain string appears anywhere in the header. For example, it would be something like... when HTTP_REQUEST { if { [HTTP::header ...
ASM Advanced WAF
asm irules
blocking page
f5irule
irule
security
  • Kevin_Davies_40's avatar
    Kevin_Davies_40
    Apr 14, 2017

    If you are referring to support ID then I assume you are using ASM. In that case then you need to create a custom signature. The instructions on how to do this can be found in the manual here and the content for your signature should be...

    headercontent:"test1234";nocase;

    There is no iRule needed for a blocking page to show a support ID. That is what will be shown by default when this signature is matched.

    If on the other hand you are not using ASM then what kind of support ID were you after?

Faruk_AYDIN's avatar
Faruk_AYDIN
Icon for Nimbostratus rankNimbostratus
Apr 14, 2017

Hi Guy,

 

Use this code:

 

when HTTP_REQUEST {
 Loop through each header by name
    foreach headerName [HTTP::header names] {
    if { [HTTP::header $headerName] contains "test1234" } {
        log local0. "$headerName header contains test1234"
        drop
        return 
    }
    }
}