Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

ITNINJAWARROIOR's avatar
ITNINJAWARROIOR
Icon for Nimbostratus rankNimbostratus
Apr 23, 2019

iRule to drop connection of invalid host header

I have an issue creating an iRule. I need the iRule to drop the connection at the F5 if the host header is manipulated. I have tried some iRules in Test but the syntax is apparently not correct.  
irules
security
WebSafe
Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Apr 23, 2019

Hi ITNINJAWARROIOR,

try the iRule to allow just a few selected HOST-header values to pass through...

when HTTP_REQUEST {
    switch -exact -- [string tolower [HTTP::host]] {
        "www.domain.de" -
        "www.domain.fr" -
        "www.domain.com" {
             Do nothing for white listed HOST-header values...
        }
        default {
             Send 502 response for reuqests with unknown HOST-headers...
            HTTP::respond 502 content "Bad Gateway" "Content-Type" "text/html" "Connection" "close"         
        }
    }
}

Cheers, Kai