IRule for Context-Specific ASM Error Page

I wrote a couple iRules to help provide some context to our users when they get dinged by the ASM. Basically, I wanted to pass in the URL of the page that generated the block, in addition to the "support ID", so I could provide a more meaningful error message to customers, rather than using a single generic error message for all page requests that get blocked. This way I can provide some helpful suggestions to address any false positives a customer may be seeing.

 

 

Here's what I have so far:

 

 

when ASM_REQUEST_VIOLATION {

 

set x [ASM::violation_data]

 

set filterId [lindex $x 1]

 

set uri [HTTP::uri]

 

Build our query string for appending to not_found.htm

 

set asm_query_string "filterId=$filterId&uri=$uri"

 

}

 

 

when ASM_REQUEST_BLOCKING {

 

set redirectTo "http://www.domain.com/not_found.htm?$asm_query_string"

 

HTTP::header insert Location $redirectTo

 

}

 

 

Within the ASM, I have the response page set as:

 

Redirect URL: http://www.domain.com/not_found.htm?filterId=<%TS.request.ID()%>

 

 

So... what happens is that when someone is blocked, the iRule overwrites the response page 301 with the version that has URI in it. I can then use PHP in the not_found.htm page to give them a meaningful, context-specific error message.

 

 

The problem is that while this works in Firefox and Safari, Chrome and Internet Explorer receive both sets of Location headers and honor the one without URI in it.

 

 

Does anyone have any suggestions on how I can make this iRule work cross-browser? Ideally, there would be a variable like <%TS.request.URI()%> I could put right in the response page in the ASM, but I couldn't find any such variable. I also tried setting an error page instead of a response page in the security policy, hoping the irule redirect would override the error page, but it didn't.

 

 

Any help would be appreciated.

 

 

-Dan