For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

sanjai_126162's avatar
sanjai_126162
Icon for Nimbostratus rankNimbostratus
Aug 22, 2016

irule to strip the uri after apm completion it has to include the lengthy uri

iRule that will capture the HTTP URI if it is larger than 1098 bytes, then strip the HTTP URI from the HTTP request that is sent to the APM. Once the Access Policy evaluation is completed and the BI...
application delivery
iRules
Stanislas_Piro2's avatar
Stanislas_Piro2
Icon for Cumulonimbus rankCumulonimbus
Aug 23, 2016

I don't understand what is the difference between the default behavior and your expected behavior...

 

as explained previously, the default behavior is:

 

  • the browser send a request to https://f5.company.com/path/
  • the apm create a new session and redirect user to /my.policy and /path/ is stored in variable session.server.landinguri
  • the user authenticate according to access policy
  • if the user authenticate successfully, the user is redirected to /path/ (stored in variable session.server.landinguri)

Your expected behavior is:

 

  • the browser send a request to https://f5.company.com/path/ if the uri length is equal or more than 1098, store it and strip it before send it to APM --> new uri is /fakepath/
  • the apm create a new session and redirect user to /my.policy and /fakepath/ is stored in variable session.server.landinguri
  • the user authenticate according to access policy
  • if the user authenticate successfully, the user is redirected to /fakepath/ (stored in variable session.server.landinguri)
  • if uri was previously store by the irule, replace the uri /fakepath/ by the stored one /path/

I ask you why because the best events to do it are ACCESS_SESSION_STARTED and ACCESS_POLICY_COMPLETED or ACCESS_ACL_ALLOWED,which are APM events.

 

So, if you want help, explain step by step what you are expecting?