For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

richkingly_1410's avatar
richkingly_1410
Icon for Altostratus rankAltostratus
Aug 06, 2015

iRule Redirect When URI Immediately Contains "#"

Hi,

 

We use a BI system that sits behind our LTM devices and I've set an iRule so that anyone browsing the site with a URI of "/" gets redirected to a landing page we've setup, whilst anyone going to a specific page goes to that specific instead.

 

The iRule code is simply a standard redirect as shown below:

 

when HTTP_REQUEST {
if { [HTTP::uri] == "/" } {
    HTTP::redirect "https://[HTTP::host]/views/LandingPage/"
 }
}

This has always worked fine but I've recently upgraded the BI system and annoyingly it's introduced a new way of re-writing URIs so that they always include a "", whatever page you go to e.g.

 

 

This means that my old iRule doesn't work anymore and gets stuck in a loop whereby whatever page I go to I always loop back to my landing page.

 

I think this is because "" is a TCL special character for comments so the F5 stops reading the URI at the "" and effectively sees every page you browse to as a request for URI "/"

 

Does anyone know a way to get around this please? I think I need to tell my iRule to escape the "" character and then keep reading the URI but can't think how.

 

Thanks in advance, Rich

 

4 Replies

  • Technically speaking, in the context that you're trying to use the hash character it isn't a TCL special character.

    Let me also first say that using hashtags as URI components is a bad idea.

    BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD
    BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD
    BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD
    BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD
    BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD
    BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD
    

    The hashtag is actually a special character in HTML and is called a fragment identifier. It is intended to point to resources that are not necessarily available on the server - in other words the hashtag is typically used in HTML to indicate resources that are subordinate components of an existing document (ie. anchor "jump to" tags in an HTML document). See the following for more information on fragment identifiers:

    https://tools.ietf.org/html/rfc3986section-3.5

    Modern browsers will not submit the hashtag portion of a URI to a server. In fact, if you're on an HTML page and click a link that points to a hashtag anchor on the same page, the browser will not submit a request at all. So try this example to see what I'm talking about:

    when HTTP_REQUEST {
        log local0. [HTTP::uri]
    
        if { [HTTP::uri] equals "/" } {
            HTTP::redirect "/site1//index.phptest"
        }
    }
    

    You can try this with pretty much any browser and even command line cURL. Make you request to the root URI (/) and you'll get a 302 redirect to "/site1//index.phptest". The very next request will be:

    /site1/
    

    Why you ask? Because the browser sees everything after the first hashtag as a fragment identifier and excludes that from the resource request, so the first hashtag removes everything after it in the URI. So in your example, let's say you issue a redirect to:

    https://bisystem//projects
    

    Browser will see everything after the first hashtag as a fragment identifier and exclude this from the request, resulting in a request to "/", which is now causing your loop.

  • Thanks for getting back to me Kevin, that clears up why this is happening and at least stops me digging for TCL escapes! If I understand correctly, I think what you are saying is:

     

    1. An iRule to redirect request to a landing page isn't a problem (and is what I already have)
    2. From there, because the system is using links with fragment identifiers it doesn't matter what I do in F5 because the browser will strip off that identifier before it even gets there. So F5 will always only just see

    It sounds like I need to craft a different way of referencing those resources, other than the fragment identifier links, but I'm not sure how to do that!

     

    Are you able to offer any tips/advice on how I can get around this please?

     

  • Thanks Kevin, I tried this out and it works to get me to my landing page but unfortunately because add_anchor always ends up as "true", thanks to our fragment identifier, this one too seems to end up in a loop when I try to go through to one of the links.

     

    It's starting to look like I might have to cut my losses with this one and either abandon the landing page or work out a way to do it server side. I've been trying to avoid the server side solution as I don't really want to tamper with the BI application's config!

     

    Thanks for the help!

     

    Rich

     

  • You could always do this very same URI evaluation in the injected JavaScript. At least there you see the full URI.