CirrusKnowing the originating request
I am unsure as to how I can correctly phrase this question, so bear with me here.
The way my current application works is as follows.
When a user hits a webpage, www.mydomian.com , it hits the F5 VS endpoint. They are presented with a F5 login form that does AD authentication. If successful, F5 grabs the AD roles they belong to, and the entered username, and injects it into the header of the request for the application to process.
Now, this all works just fine as expected. My application reads the headers, and let's the user perform actions based on what data was received in the header. Now, I want to implement a "logout" feature for the application, where the F5 client side connection is terminated.
The documentation of F5 provides a solution to this, where we can add a logout url to the Access Policy configuration. When a user hits some url, they are logged out, after a predefined timout period. While this is a good solution, I am looking something to meet the following scenario:
After the user is done performing actions in F5, he clicks logout. Logout action wipes the headers and redirects back to F5. (I can do all of this in the application without a problem) The trick here is that the user is never accessing a url when they click logout, as in, the url does not change. So I am unaware as to how I can alter F5 that the session needs to end for that particular client connection.
Ideas: One way I was thinking about solving this problem, is by adding an additional header once the logout process initiates in the application. For the purpose of this question, we can call it "action" = "logout" . If this is the case, then I can attach an iRule to the VS, and for every http_request check if that header exists; in which case, the session should be deleted.
Is this a good solution to make this work? Is there a better way to alert F5 that a session needs to end, without relying on the uri, that would work in a better way for my header based authentication?
"...The trick here is that the user is never accessing a url when they click logout..."
So, you have some JS stuff that is running I guess. There are some options:
- Can you call an ajax request here (onclick, etc) to push the logout request to APM?
- You can delete the user's session cookie with JS. But it must not be HTTPONLY in that case. And if you can't inform the APM that the session is deleted, then you have an idle session sticking around until the idle timeout.
- You can delete the APM session in irules if you want, but you have to simultaneously issue a set-cookie header to the client (or do it with JS) in order to delete the client's cookie, or it will try to access the APM with a bad session ID.
Your header idea is a little bit unconventional, but could work. How are you getting the client to add headers to its request or is it the server's response?
