Forum Discussion
Mobile redirect with forced SSL
Hi guys,
I am faced with dual puzzle for site demending dual function redirect causing some issses.
I need to provide detection process from www.main.com site provide mobile type version/release services.
I establised individual VIP exposed and registered externally with m.main.com. Requests sourcing from mobile devices are detected and redirected to m.version VIP using script I enclosed below. It works well and relatively all devices are detected and rediected properly. All are happy and I still have the job. Problem develops with adding SSL force redirect after mobile deterction takes place. Standard http_https_redirect fails to complete after my first script runs.
Concept is relatively simple. All traffic to standard VIP is redirected to SSL. Same applies to mobile frame devices and they all need to be SSL forced.
Can you please share some light on single or dual step scripts you know work with this requirements?
I appreciate your help .
when HTTP_REQUEST {
switch -glob [string tolower [HTTP::header User-Agent]] {
"*blackberry*" -
"*windows ce*" -
"*palm*" -
"*sonyericsson*" -
"*lg*" -
"*sie*" -
"*up.b*" -
"*up*" -
"*motorola*" -
"*mot-*" -
"*astel;*" -
"*j-phone*" -
"*netfront*" -
"*xiino*" -
"*iphone*" -
"*benq*" -
"*cricket*" -
"*andr*" -
"*htc*" -
"*nokia*" -
"*portalmmm *" -
"*samsung*" -
"*sec*" -
"*vodafone*" -
"*smartphone*" -
"*symbian*" {
HTTP::redirect "]"
return
}
}
if { [string tolower [HTTP::header Accept]] contains "vnd.wap.wml" } {
HTTP::redirect "]"
return
}
if { [HTTP::header exists "MSISDN"] } {
HTTP::redirect "]"
return
}
- hooleylistCirrostratusHow many virtual servers do you have for these two hostnames? Do you have an http and https VS for both? Which VS(s) do you want to redirect from http to https?
- Chris_D_15752Nimbostratus
I have a single publically available port 80 VS built for “main” site with addition of VS on same IP address providing final target for SSL termination.Mobile devices need to be detected and redirected on the first hit on port 80 to www.main.com site and port 80 VS. Once detected, redirect takes place to m.site.com. M site has same two VIPS as well but is new and can be modified accordingly.When I install redirection script shown, I get redirection working well but SSL redirection with second script fails, regardless where is this applied.I think,It is also safe to say, that m.site needs to respond to port 80 requests as well so it would not be easy to handle SSL requests only on m.site.com VS. M.test.com farm has 4 members in the farm under SSL VIP.Thanks for sharing your thougths - - Colin_Walker_12Historic F5 AccountSo basically, if I understand this correctly, you want to redirect all traffic from 80 -> 443, but with any request coming from a mobile device (as defined by your list of Use-Agents) you want to redirect them to https://m.site.com instead of https://site.com?
when HTTP_REQUEST { switch -glob [string tolower [HTTP::header User-Agent]] { "*blackberry*" - "*windows ce*" - "*palm*" - "*sonyericsson*" - "*lg*" - "*sie*" - "*up.b*" - "*up*" - "*motorola*" - "*mot-*" - "*astel;*" - "*j-phone*" - "*netfront*" - "*xiino*" - "*iphone*" - "*benq*" - "*cricket*" - "*andr*" - "*htc*" - "*nokia*" - "*portalmmm *" - "*samsung*" - "*sec*" - "*vodafone*" - "*smartphone*" - "*symbian*" { HTTP::redirect "https://msite.web.com[HTTP::uri]" return } } if { [string tolower [HTTP::header Accept]] contains "vnd.wap.wml" } { HTTP::redirect "https://msite.web.com[HTTP::uri]" return } if { [HTTP::header exists "MSISDN"] } { HTTP::redirect "https://msite.web.com[HTTP::uri]" return } if {[TCP::local_port] != 443 }{ HTTP::redirect "https://[HTTP::host][HTTP::uri] }
- Chris_D_15752Nimbostratus
Hi Colin and and thank you for your help. I tried sligtly modified version you attached and noticed it does not work.
- Colin_Walker_12Historic F5 AccountIt sounds like this approach will work well for you then, you just need to get a more specific list of User-Agents. One of the User-Agents in your list must be catching IE8 and redirecting it. Perhaps try removing them one by one and testing to see which it is? My guess would be windows ce, but it's hard to tell.
- hooleylistCirrostratusI'd be concerned with false matching on the really short patterns like these:
- Colin_Walker_12Historic F5 AccountAgreed that making the matches as unique and detailed as possible is a good thing. The shorter/more ambiguous they are the more chances you have for errors.
- Chris_D_15752Nimbostratus
Thanks guys,
- hooleylistCirrostratusA few of the lines in the switch statement were missing the hyphen. I also set the User-Agent string to lower case so you don't have to use multiple patterns to handle mixed cases.
when HTTP_REQUEST { if { [string tolower [HTTP::host]] contains "nativeweb-site.com" } { switch -glob [string tolower [HTTP::header User-Agent]] { "*blackberry*" - "*blazer*" - "*palm*" - "*smartphone*" - "*danger*" - "*hiptop*" - "*mot-*" - "*razr*" - "*audiovox*" - "*symbian*" - "*nokia*" - "*sony ericsson*" - "*samsung*" - "*lg 8*" - "*alcatel 735i*" - "*nextel*" - "*windows ce*" - "*audiovox*" - "*au-mic,*" - "*alcatel*" - "*benq*" - "*casio*" - "*cdm-*" - "*ericsson*" - "*ezos*" - "*kyok*" - "*kyocera*" - "*lg-*" - "*lge-*" - "*nec-*" - "*nokia*" - "*nok6*" - "*nokia*" - "*mitsu*" - "*mot-*" - "*motorola*" - "*sagem*" - "*sagem*" - "*sendo*" - "*sonyericsson*" - "*panasonic*" - "*pantech*" - "*qc-*" - "*playstation portable*" - "*philips*" - "*samsung*" - "*sama*" - "*sec-s*" - "*sec-n*" - "*sanyo*" - "*sharp*" - "*sie-*" - "*sony*" - "*symbianos*" - "*symbian os*" - "*portalmmm*" - "*vodafone/*" - "*kddi-*" - "*j-phone*" - "*blazer*" - "*avantgo*" - "*avantbrowser.com*" - "*danger*" - "*hiptop*" - "*proxynet*" - "*iemobile*" - "*mobileexplorer*" - "*.web*" - "*palm*" - "*series60*" - "*palmsource*" - "*palmos*" - "*midp-2.0*" - "*midp-1.0*" - "*cldc-1.0*" - "*cldc-1.1*" - "*series60*" - "*opera mini*" - "*mobilephone*" - "*netfront*" - "*nitro*" - "*docomo*" - "*obigo*" - "*pocketpc*" - "*pocket pc*" - "*regking*" - "*smartphone*" - "*smartphone*" - "*epoc*" - "*rover*" - "*ipaq*" - "*jornada*" - "*iopus*" - "*inassap*" - "*minimo*" - "*plucker*" - "*ericy*" - "*softbank*" - "*willcom*" - "*yospace*" - "*tagtag*" - "*winwap*" - "*up.link*" - "*pdxgw*" - "*astel*" - "*wap1.*" - "*xiino*" - "*up/4*" - "*maemo*" - "*windows ce*" - "*mspie*" - "*microsoft pocket internet explorer*" - "*elaine*" - "*eudoraweb*" - "*reqwirelessweb*" - "*jbrowser-wap*" - "*lenovo*" - "*m3gate*" - "*cellphone*" - "*sony cmd*" - "*wapsilon*" - "*telme*" - "*linux armv*" - "*sony/com1*" - "*embedix armv5tel*" - "*xplore g*" - "*mobileok ddc*" - "*google wap proxy*" - "*google chtml proxy*" - "*netfront*" { HTTP::redirect "http://mobile.site.com[HTTP::uri]" return } } if { [string tolower [HTTP::header Accept]] contains "vnd.wap.wml" } { HTTP::redirect "http://mobile.site.com[HTTP::uri]" return } if { [TCP::local_port] != 443 }{ HTTP::redirect "https://nativeweb-site.com[HTTP::uri]" } } }
- Chris_D_15752NimbostratusHi Aaron,
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com