For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Brandon's avatar
Brandon
Icon for Cirrostratus rankCirrostratus
Feb 03, 2021

irule to look to see if the value is in the Body

I was trying to figure out how to write an iRule to look for a parameter in the Body. I thought the token would be in the header. However the developer put it in the body. How do I look in the body o...
application delivery
BIG-IP
iRules
Amine_Kadimi's avatar
Amine_Kadimi
Icon for MVP rankMVP
Feb 03, 2021
when HTTP_REQUEST {
  if {[HTTP::method] eq "POST"}{
    if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= 1048576}{
      set content_length [HTTP::header "Content-Length"]
    } else {
        set content_length 1048576
    }
    if { $content_length > 0} {
      HTTP::collect $content_length
    }
  }
}
when HTTP_REQUEST_DATA {
  log local0. "Token = [findstr [HTTP::payload] "token=" 6 &]"
}

source: https://support.f5.com/csp/article/K07535385

  • Daniel_Wolf's avatar
    Daniel_Wolf
    Icon for MVP rankMVP
    Feb 04, 2021

    This is the way, however I would be careful to implement it. I'd recommend to do performance testing before deploying it in a production environment.

    Just recently I had a similar requirement and it works good with small requests. However the customer had POST requests up to 400kb. Then this suddenly becomes heavy on the CPU.