log response ASM cookies

Hello Aaron,

 

 

Thanks for the i-Rule.

 

How can I add the URI to the log ?

 

(I need to check that the client receives all the TS cookies I expect he should receive according to our ASM policy).

 

If I add an HTTPRequest event will it log the URI that matches the Response URI?

 

 

when HTTP_REQUEST {

 

if {[IP::addr [IP::client_addr] equals 195.250.33.253]}{

 

set uri [HTTP::uri]

 

log local0. "$uri "

 

}

 

}

 

 

when HTTP_RESPONSE {

 

only look for TS cookies if it's a response to the specific client

 

 

if {[IP::addr [IP::client_addr] equals 195.250.33.253]}{

 

loop through cookie names

 

foreach aCookie [HTTP::cookie names] {

 

log cookie names and values that start with TS

 

if { $aCookie starts_with "TS"}{

 

log local0. "client: [IP::client_addr] has cookie $aCookie=[HTTP::cookie value $aCookie]"

 

}

 

}

 

}

 

}