Forum Discussion

Dan_103960's avatar
Dan_103960
Icon for Nimbostratus rankNimbostratus
Aug 18, 2011

Modify content in error 500 server response to client

I don't know if this is even possible yet but thought I'd bounce it out here.

 

 

I'm looking to see if there's a way to modify the content in an error 500 page being returned to the client to sanitize some info for security reasons.

 

 

Having the ASM block all error 500's is not an option at this time as the application needs them for user error in some places. I know....500 is supposed to be not used for this purpose, but even if the app guys coded the error to 5xx they'd still be asking to remove the unwanted data.

 

 

I can't think of a way to trigger the event based on return traffic yet, but can't rule it out yet.

 

 

In the end I have no problem saying it's not doable and it's either all or none until you re-code the app, but just looking for verification.

 

 

Thanks,

 

Dan

 

app sec
BIG-IP Access Policy Manager (APM)
security
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Aug 18, 2011
    Hi Dan,

     

     

    You could potentially do this using the ASM_RESPONSE_VIOLATION iRule event (v10.1.0+). You'd want to have the illegal status in response marked for alarming, but not blocking.

     

     

    http://devcentral.f5.com/wiki/iRules.ASM_RESPONSE_VIOLATION.ashx

     

     

    You can then use ASM::payload to get the current app payload.

     

     

    Aaron