Need to allow request only if application opens from parent portal

Hi,

You can use ASM module to force url access through a specific workflow "URL Flow".

You can use APM and extend the session cookie domain to fit both apps. Then, with an irule, you can check for valid session and grant access or deny/redirect user.

Not sure if this is good in terms of security but you can use an irule to identify the referer and provide a cookie, here is the logic :

when HTTP_REQUEST {
    set insert_cookie 0
    if { !([HTTP::cookie exists MRH]) } {
        reject
    }
    if { [HTTP::header Referer] eq "https://myportal.com/index.html" } {
        set insert_cookie 1
    }
}

when HTTP_RESPONSE {
    if { [info exists insert_cookie] and $insert_cookie == 1 } {
        HTTP::cookie insert MRH value "some verifiable encrypted string"
    }
}

That's the concept, then you should then add some security around the cookie value generation