Marking server traffic secure

Hi DaveC,

 

 

You can use a Stream profile to replace instances of http://mysite.com with https://mysite.com in the HTTP response. There is an example of this functionality under the "Examples" section of the STREAM::expression wiki page. Hope that helps,

 

 

-George

Hi George,

 

 

Thanks for the response. I don't think I want to replace http with https because I only support http to the server. The developer ideally would like to insert a new header, something like the x-forwarded-for header, to have some way for the site/app to know the connection to the client is secure. I already know absolutely if the connection is secure because the VS it goes through only supoorts https to the client. I'm not sure what to even ask for, let alone how to do it.

 

 

Dave

This is what we do on the HTTP and HTTPS virtuals respectively:

when HTTP_REQUEST {
if { [HTTP::header exists "HTTP_X_FORWARDED_PROTO"] }{
HTTP::header replace "HTTP_X_FORWARDED_PROTO" "http"
}
else {
HTTP::header insert "HTTP_X_FORWARDED_PROTO" "http"
}
}

when HTTP_REQUEST {

if { [HTTP::header exists "HTTP_X_FORWARDED_PROTO"] }{

HTTP::header replace "HTTP_X_FORWARDED_PROTO" "https"

}

else {

HTTP::header insert "HTTP_X_FORWARDED_PROTO" "https"

}

}

That looks nasty, sorry. For the HTTPS virtual:

when HTTP_REQUEST {
if { [HTTP::header exists "HTTP_X_FORWARDED_PROTO"] }{
HTTP::header replace "HTTP_X_FORWARDED_PROTO" "https"
}
else {
HTTP::header insert "HTTP_X_FORWARDED_PROTO" "https"
}
}

For the HTTP virtual:

when HTTP_REQUEST {
if { [HTTP::header exists "HTTP_X_FORWARDED_PROTO"] }{
HTTP::header replace "HTTP_X_FORWARDED_PROTO" "http"
}
else {
HTTP::header insert "HTTP_X_FORWARDED_PROTO" "http"
}
}

I figured it out. It was really pretty easy. Just needed the time to think and investigate it. The rule below works correctly. Thanks for all the responses.

 

 

when HTTP_REQUEST {

 

HTTP::header insert IsSecureConnection True

 

}

You could also do this with a custom HTTP profile:

ltm profile http IsSecureConnection_http {
    defaults-from http
    header-erase IsSecureConnection
    header-insert "IsSecureConnection: True"
    insert-xforwarded-for enabled
}

Aaron