For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

KeesvandenBos's avatar
KeesvandenBos
Icon for MVP rankMVP
Jan 26, 2017

Modify LTM+APM inactivity timer on one url

Hi,

 

I have a website behind the APM in LTM+APM mode. The default inactivity timeout is 15 minutes. This should stay 15 minutes for this site except for one url. This is a url to a form which takes very long to fill out. (in portal mode the user receiver a java pop-up when there are 5 minutes left to go in the session, asking the user to disconnect or to continue)

 

I have tested it with an irule to change the session.inactivity_timeout when the uri of the form is hit. It is changes to the new value but under manage sessions the timeout still stays 15 minutes.

 

Is there a way to send the portal mode inactivity pop-up to users in LTM+APM mode? Or is there a way to insert a small java script that will keep the session alive when visiting this one uri?

 

Cheers,

 

Kees

 

application delivery
BIG-IP Access Policy Manager (APM)
security

1 Reply

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jan 26, 2017

    Hi,

    to insert a javascript, you can use this irule:

    when RULE_INIT {
    set static::jscript {}
}

when ACCESS_ACL_ALLOWED {
     Disable the stream filter by default 
    if { [catch {STREAM::disable}] } {log local0. "Stream disable error"}
    set insertJscript 0 
    HTTP::header remove "Accept-Encoding"
    set extend_session 0
    if {[HTTP::uri] equals /myuri } {set extend_session 1}
}


when HTTP_RESPONSE { 
    if {$extend_session && ([HTTP::status] == 200) && ([HTTP::header value Content-Type] contains "text")} { 
        set insertJscript 1
        STREAM::expression "@@$static::jscript@"
        STREAM::enable
    }
    if {[HTTP::header exists "Transfer-Encoding"]} {
        HTTP::payload rechunk
    }
}


when STREAM_MATCHED {
     Once we've hit one match, disable the stream filter for the rest of the response
    if { $insertJscript} {
        log local0. "Session Closed detection : Javascript inserted"
        STREAM::disable
    }
}

    then, add the following script file in APM hosted content with private properties (I do not remember the real keyword):

    function detectSessionClosed()
{
    var rq = new XMLHttpRequest();
    rq.open("GET","/public/share/myjavascript.js",false);
    rq.send(null);
    if (rq.status === 302) {
      window.location.assign("/vdesk/hangup.php3");
    }
}

setInterval( detectSessionClosed, 600000);

    this script try to download itself every 10 minutes until the user leave the page.