Forum Discussion
Rajesh_74831
Nimbostratus
May 25, 2010Need a irule which can remove ETAG information from the site
Hi Guys,
I am not that expert in writing irule, was googling for a specific issue and came across this forum, so thought I can get some help from you guys.
Here is my question, we found a vulnerability that Etag information is disclosed in the site, which is what we do not want as per our security policies. I had applied the fix to the web servers and no longer see when we hit the web server directly. But we still see the vulnerability when hitting the Load Balancer.. so thought we might need a irule which can mask the ETAG information.
After some googling I saw an irule can be used to specifically say what headers need to be visible to the site .. so I think it is also possible to specify what not to show.
http://devcentral.f5.com/wiki/default.aspx/iRules/ServerResourceCloaking.html
Please help me...
-Rajesh
- Rajesh_74831
Nimbostratus
I think I was able to get it ...following is the Irule used to mask the etag in the site. when HTTP_RESPONSE { HTTP::header remove "Etag" }
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects