Forum Discussion

Rajesh_74831's avatar
Rajesh_74831
Icon for Nimbostratus rankNimbostratus
May 25, 2010

Need a irule which can remove ETAG information from the site

Hi Guys, I am not that expert in writing irule, was googling for a specific issue and came across this forum, so thought I can get some help from you guys. Here is my question, we found a vulnerability that Etag information is disclosed in the site, which is what we do not want as per our security policies. I had applied the fix to the web servers and no longer see when we hit the web server directly. But we still see the vulnerability when hitting the Load Balancer.. so thought we might need a irule which can mask the ETAG information. After some googling I saw an irule can be used to specifically say what headers need to be visible to the site .. so I think it is also possible to specify what not to show. http://devcentral.f5.com/wiki/default.aspx/iRules/ServerResourceCloaking.html Please help me... -Rajesh
  • I think I was able to get it ...following is the Irule used to mask the etag in the site. when HTTP_RESPONSE { HTTP::header remove "Etag" }