Forum Discussion
Anirban
Nimbostratus
NimbostratusPayload string based persistence
1) CLient sent HTTP request with user id and password 2) Server responds with SESSIONID in XML file after successfull login. 3) CLient sent HTTP request with SESSIONID in xml file ecery time 4) Se...
Hi Anirban, you will very likely have to start collecting the data and lookup the collected payload in the context of the HTTP_RESPONSE_DATA event.
There is a how-to in the event man page for HTTP_RESPONSE_DATA.
Please make also sure to remove the Accept-Encoding header in the context of HTTP_REQUEST. Header manipulation is described here: HTTP::header. By removing the Accept-Encoding header you prevent the server from sending compressed data.
Please check, if the payload send by the client has the Expect header (Expect: 100). Let me know, if this is the case. I had a similar issue a while ago and may have a solution based on collecting CLIENT_DATA or CLIENTSSL_DATA.
AnirbanNimbostratus
NimbostratusThanks a lot.....
I have configured as below as per your suggestion
when HTTP_RESPONSE {
if {[string length [findstr [HTTP::payload] "<return>" 8 "</return>"]] == 30}{
if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= 1048576}{
set content_length [HTTP::header "Content-Length"]
} else {
set content_length 1048576
}
if { $content_length > 0} {
HTTP::collect $content_length
}
}
}
when HTTP_RESPONSE_DATA {
persist add uie [findstr [HTTP::payload] "<return>" 8 "</return>"] 1800
log local0. "Responset SessionID: [findstr [HTTP::payload] "<return>" 8 "</return>"]"
}
when HTTP_REQUEST {
if {[string length [findstr [HTTP::payload] "<arg0>" 6 "</arg0>"]] == 30}{
if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= 1048576}{
set content_length [HTTP::header "Content-Length"]
} else {
set content_length 1048576
}
if { $content_length > 0} {
HTTP::collect $content_length
}
}
}
when HTTP_REQUEST_DATA {
persist uie [findstr [HTTP::payload] "<arg0>" 6 "</arg0>"] 180
log local0. "Request SessionID: [findstr [HTTP::payload] "<arg0>" 6 "</arg0>"]"
}
Its working 90% of the time but not all time.
Observation:
When F5 receive Request SessionID first then it started malfunctioning(10% time). I dont know why F5 can not extract Response SessionID from RESPONSE_DATA all the time.