For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

tminfw2's avatar
tminfw2
Icon for Nimbostratus rankNimbostratus
Aug 25, 2016

iRule: Referer header not removed in HTTP request

In order to test a possible solution for a problem, I want to remove the Referer header for certain incoming requests. This is the irule I created and added to the impacted virtual server:

when HTTP_REQUEST { 
     if { ( [HTTP::uri] contains "abc") && ( [HTTP::header "Referer"] contains "def")} {
              log local0. [HTTP::header "Referer"]
              HTTP::header remove "Referer"
              log local0. [HTTP::header "Referer"]
     }
}

However, when I take a tcpdump on the SNAT address of the virtual server, I can still see the Referer header with content being sent to our webservers. The logs above do show the Referer content being erased

Version 11.5.4

1 Reply

  • Take the tcp dump on the server. Make sure that the right case (lower/upper) is utilized.