For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Brandon's avatar
Brandon
Icon for Cirrostratus rankCirrostratus
Feb 03, 2021

irule to look to see if the value is in the Body

I was trying to figure out how to write an iRule to look for a parameter in the Body. I thought the token would be in the header. However the developer put it in the body. How do I look in the body of a http req.

 

Thanks for your help.

 

when HTTP_REQUEST {

  if { [HTTP::uri] equals "login.aspx" } {

    if { [HTTP::header exists "token"] } {

      log local0. "Request from [IP::client_addr] for login.aspx includes HTTP header token with value: [HTTP::header "token"]"

    } else {

      log local0. "Request from [IP::client_addr] for login.aspx does not include HTTP header token"

    }

  }

}

 

application delivery
BIG-IP
iRules

2 Replies

  • Amine_Kadimi's avatar
    Amine_Kadimi
    Icon for MVP rankMVP
    Feb 03, 2021
    when HTTP_REQUEST {
  if {[HTTP::method] eq "POST"}{
    if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= 1048576}{
      set content_length [HTTP::header "Content-Length"]
    } else {
        set content_length 1048576
    }
    if { $content_length > 0} {
      HTTP::collect $content_length
    }
  }
}
when HTTP_REQUEST_DATA {
  log local0. "Token = [findstr [HTTP::payload] "token=" 6 &]"
}

    source: https://support.f5.com/csp/article/K07535385

    • Daniel_Wolf's avatar
      Daniel_Wolf
      Icon for MVP rankMVP
      Feb 04, 2021

      This is the way, however I would be careful to implement it. I'd recommend to do performance testing before deploying it in a production environment.

      Just recently I had a similar requirement and it works good with small requests. However the customer had POST requests up to 400kb. Then this suddenly becomes heavy on the CPU.