For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

george_wang_323's avatar
george_wang_323
Icon for Nimbostratus rankNimbostratus
Jan 25, 2007

parsing http response body has no performance impact?

We have a requirement to ensure that none of our web applications contains a specific text string (let's use the string "invalid:word" as an example). Because we have F5 BigIP in front of all web servers, one thought is to use iRule to filter the HTTP response body.

 

 

Is this a good idea in terms of performance? could some one show me an example of how to do it? should I use "HTTP::collect [] " and "HTTP::payload [] "?

 

 

Thanks,

 

 

George
application delivery
dev
devops
iRules

1 Reply

  • AaronJB's avatar
    AaronJB
    Ret. Employee
    Jan 25, 2007
    I think you might find greater performance using the Stream profile and it's pattern matching for this - especially if all you want to do is a 'search & replace' on the outgoing stream.

     

     

    If you want to drop connections and/or send an alternative response based on the stream pattern matching then that is possible via an additional iRule - but I would think that using the matching of the stream profile to trigger the iRules 'STREAM_MATCHED' event would be far better than using the ::collect methods to collect entire HTTP responses.

     

     

    I think if you search for "STREAM_MATCHED" here on the forums you'll find some discussions that might point you in the right direction.

     

     

    --

     

    Aaron