For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Juanma_47808's avatar
Juanma_47808
Icon for Nimbostratus rankNimbostratus
Mar 30, 2008

Java script redirection problem

 

Hello,

 

 

I am trying to set up a BigIP LTM to load balance a https service. There is an upload page in the WEB that uses a java script that changes the URL client from:

 

 

https://virtualserver.mydomain.com

 

to

 

https://realserver.mydomain.com.

 

 

I have checked out in the http exchange but I have not found any redirection (3xx) or any parameter in the header reponse with the real server. I can only see that the client receives configuration paths to java files and afther that, the client changes from URL.

 

 

The problem is that I can´t modify java script code because it owns to a third corporate.

 

 

I would need to keep the same virtual server URL for the complete SSL session, without any jump to real load balanced servers. Is that possible?

 

 

Could you help me please?

 

 

 

I have never seen any forum as useful as this.

 

Thanks a lot for your help.

 

 

Juan

 

application delivery
dev
devops
iRules

7 Replies

  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Mar 31, 2008
    It's sounds like javascript isn't doing the redirection, but probably executing a class object in a jar file that the client is being pointed to. Is that Javascript critical to the overall functionality of the website or does it simply serve to redirect?
  • Juanma_47808's avatar
    Juanma_47808
    Icon for Nimbostratus rankNimbostratus
    Mar 31, 2008

     

    Hello cmbhatt,

     

     

    the javascript is called when the client wants upload a file to the WEB. When I connect to the server without BigIP in-between, I ever works with the same host in the URI. The problem appeared when I use BigIp between client and real servers. I am affraid that this javascript is very important in the web.

     

     

    I opened this topic in order to know if it is possible to fix the host int the URI's client side to avoid any jump to the real servers due to a java script.

     

     

    Thanks a lot.

     

     

     

  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Mar 31, 2008
    I think I understand your point. You might want to look at SSL rewriting options within the SSL PROFILE. Another item is to use an IRULE such as the following

    
when HTTP_REQUEST {
  switch [HTTP::host] {
     "realserver.mydomain.com" { HTTP::redirect https://virtualserver.mydomain.com/[uri]" }
  }
}

    or 

    
when HTTP_REQUEST {
  if { [HTTP::host] eq " realserver.mydomain.com" } { HTTP::redirect https://virtualserver.mydomain.com/[uri]" }
}

    I have tested this out but it's worth a show if you can't adjust the SSL Profile settings.

    Hope this helps

    /CB

  • Juanma_47808's avatar
    Juanma_47808
    Icon for Nimbostratus rankNimbostratus
    Apr 01, 2008
    Hello cmbhatt,

     

     

    I have tried your suggestion but I doesn´t work. The reason might be that when client web browser executes the irritable java script and it changes host name in the URL sended to the BIGIP, it doesn´t match my virtual server IP address (that includes the specific irule). I tried to set up a wildcard virtual server instead of a host virtual server in order to apply your irule, but the problem is that BigIP is far away from client subnet and there are level 3 switches and firewalls between.

     

     

    I think that the best choice will be to contact to the java script programmer in order to modify the "hide" redirection.

     

     

     

    Thanks a lot in any case

     

     

    Juanma
  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Apr 01, 2008
    I can certainly say that the idea scenerio is to fix the code so BIGIP doesn't necessary have to mask the issue.

     

     

    However, is a quote by Joe, that I found that may help you

     

     

    Posted By Joe on 03/30/2007 1:27 PM

     

     

    This is overlooked most of the time, but if you want a simple string replacement, the easiest solution is to use a Stream Profile associate with your virutal. There are no iRules involved. Just create a stream profile with the Source value as "www.somedomain.com/someuri" and the Target value as "www.somedomain1.com/somenewuri" and apply it to your virtual.

     

     

    Keep in mind that the stream profile will only work with fixed strings, regular expressions and wildcards are not supported.

     

     

    -Joe

     

     

     

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Apr 02, 2008
    When using a stream profile, it's a good idea to configure it with an iRule so that the stream filter is only applied when you intend it. Here is an example:

    
when HTTP_RESPONSE {
   Disable the stream filter by default
  STREAM::disable
  if {[HTTP::header value Content-Type] starts_with "text"} {
     Replace the modified domain with the original
    STREAM::expression "@realserver.mydomain.com@virtualserver.mydomain.com@"
 
     Enable the stream filter for this response only
    STREAM::enable
  }
}

    Aaron
  • Juanma_47808's avatar
    Juanma_47808
    Icon for Nimbostratus rankNimbostratus
    Apr 04, 2008

     

    Hello,

     

     

    I have tried with "streams" as you advised me. It solves 50% of my problem. There are two java scripts to upload files to the WEB. First java script sends an HTTP request to the client that includes real servers hostsnames configuration for the JS in the header; your irule works fine. Second java script does not send any information into the HTTP header; your irule didnt work. I changed a variable in each apache server behind the BigIP:

     

     

    HTTPD_SERVERNAME=real_name.domain.com

     

     

    to

     

     

    HTTPD_SERVERNAME=virtual_server_name.domain.com

     

     

    and now java scripts do not modify client URL. Any jump to the real_name.domain.com ends in virtual_server_name.domain.com. Fortuantely it has not been necessary to modify any javascript.

     

     

    I am grateful for your help (cmbhatt and Aaron)

     

     

    Best regards