Forum Discussion

Joe_Pipitone's avatar
Joe_Pipitone
Icon for Nimbostratus rankNimbostratus
Aug 11, 2015

Mobile browsers broken - https redirect

BigIP 1600's - v11.6 HF 4

I have a simple iRule that forces https and strips the www. We have a CMS running that automatically detects the user agent, and redirects the mobile browser to the mobile version of the website. As soon as I applied the following iRule, mobile browsers appeared to be broken upon the first initial page load request.

With mobile Safari on iOS, (as well as Android) I get the following message when I browse the site:

"Safari cannot open the page because it could not load any data"

If I refresh the page a 2nd time, the mobile version of the website loads.

What would be the best way to troubleshoot this? Would I need to implement logging to capture the user agent, and where the client is trying to go? Why would a refresh cause the page to load on the 2nd attempt?

Here's the iRule:

when HTTP_REQUEST {
    if {([string tolower [HTTP::host]] starts_with "www.")} {
        HTTP::redirect "https://[string range [HTTP::host] 4 end][HTTP::uri]"
        return
    } elseif { [TCP::local_port] == 80 } {
        HTTP::redirect https://[HTTP::host][HTTP::uri]
        return
    }
}
application delivery
devops
https
irule
iRules
LTM
  • Joe_Pipitone's avatar
    Joe_Pipitone
    Icon for Nimbostratus rankNimbostratus
    Aug 13, 2015
    I've just done a new test - I setup a generic website with just a "hello world" html page, no mobile browser redirection, etc. I received the same "Safari cannot open the page because it could not load any data." The issue appears to happen when the irule is attempting to force SSL.
  • Joe_Pruitt's avatar
    Joe_Pruitt
    Aug 13, 2015

    Most likely your issue is the "TCP::local_port". Check out the docs for an example with all the values:

    https://devcentral.f5.com/wiki/iRules.TCP__local_port.ashx

    You'll likely want to use [TCP::Local_port clientside] if you are looking for the front end VIPs port. Omitting the "clientside" is the same as using "serverside".

    This potentially should work (haven't tested it thought)

    when HTTP_REQUEST {
    if {([string tolower [HTTP::host]] starts_with "www.")} {
        HTTP::redirect "https://[string range [HTTP::host] 4 end][HTTP::uri]"
        return
    } elseif { [TCP::local_port clientside] == 80 } {
        HTTP::redirect https://[HTTP::host][HTTP::uri]
        return
    }
}

    Beyond that, I'd recommend adding in some log statements and making sure the values you are expecting to match on are working as you expect.

  • Joe_Pipitone's avatar
    Joe_Pipitone
    Icon for Nimbostratus rankNimbostratus
    Aug 14, 2015

    The problem was the headers that I was inserting for HSTS. As soon as I removed them, safari started acting normally. Here's the full iRule that includes the header inserts. Very strange behavior, as other mobile browsers handled this just fine:

    when RULE_INIT {
   set static::expires [clock scan 20110926]
}
when HTTP_RESPONSE {
   HTTP::header insert "Strict-Transport-Security" "max-age=15552000; includeSubDomains"
}
when HTTP_REQUEST {
    if {([string tolower [HTTP::host]] starts_with "www.")} {
        HTTP::redirect "https://[string range [HTTP::host] 4 end][HTTP::uri]"
        return
    } elseif { [TCP::local_port clientside] == 80 } {
        HTTP::redirect https://[HTTP::host][HTTP::uri]
        return
    }
}