For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

DScottSLC_13452's avatar
DScottSLC_13452
Icon for Nimbostratus rankNimbostratus
Jan 06, 2015

Redirect non www and https issue

Hi, We have two Irules on a Virtual Server pool that seem to be causing an intermittent issue for some clients / browsers.

 

_sys_https_redirect (the default F5 one included on the BIGIP boxes) and our own custom one shown below.

 

when HTTP_REQUEST { if { [string tolower [HTTP::host]] equals "pennyforlondon.com" } { HTTP::respond 301 Location "https://www.pennyforlondon.com[HTTP::uri]" } }

 

We have our Irule first followed by the _sys_http Irule.

 

This however gives us the following error in the logs.

 

TCL error: /Common/_sys_https_redirect - Operation not supported. Multiple redirect/respond invocations not allowed

 

The issue we face is if we remove either of these it causes issues displaying the website so we need to use them both.

 

We support non www, www. and forward from http force it to use https for our SSL cert to work.

 

Any ideas on how these two Irule can co-exist and not cause weird intermittent redirection issues which only some clients get on occasion.

 

Thanks, Dylan.

 

application delivery
devops
iRules

5 Replies

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Jan 06, 2015

    can you try something like this?

    when HTTP_REQUEST { 
  if { [string tolower [HTTP::host]] equals "pennyforlondon.com" } { 
    HTTP::respond 301 noserver Location "https://www.pennyforlondon.com[HTTP::uri]" Connection Close
    event HTTP_REQUEST disable
  } 
}

    by the way, why don't you combine irules together? shouldn't it be simpler and cleaner?

  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Jan 06, 2015

    Dylan - would this one iRule work?

    when HTTP_REQUEST { 
   if { [string tolower [HTTP::host]] equals "pennyforlondon.com" } { 
   HTTP::respond 301 Location "https://www.pennyforlondon.com[HTTP::uri]" 
   } else {
   HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
}
  • Michael_Jenkins's avatar
    Michael_Jenkins
    Icon for Cirrostratus rankCirrostratus
    Jan 06, 2015

    The best way that I've found to do this is using the 

    event
    command More info here.

    Because you can't have multiple redirects, you would either need to set a flag to say a redirect has already occurred and check it later (which obviously wouldn't work for the built-in rule). Otherwise, you could use the event command. I would say you could change the Location header in the HTTP_RESPONSE event, but I don't think that gets executed when you do a redirect from an iRule.

    So, my suggestion would be something like this:

    when HTTP_REQUEST { 
    if { [string tolower [HTTP::host]] equals "pennyforlondon.com" } { 
         Disable further events for this connection 
        event disable all

         Redirect the user. Make sure to add the Connection Close header because the event command is set per connection. So we need a new connection in order for the rules to execute again.
        HTTP::respond 301 Location "***REPLACE***[HTTP::uri]" "Connection" "Close"
    } 
}

    NOTE: Replace 

    ***REPLACE***
    with https://www.pennyforlondon.com. The editor messes up URLs when posting, so just replace it in your iRule and you should be good.

    Hope this helps.

  • DScottSLC_13452's avatar
    DScottSLC_13452
    Icon for Nimbostratus rankNimbostratus
    Jan 07, 2015

    Thanks for all the fast responses, amazing! I will be testing each of the above solutions over the next day or so and post the results. Very much appreciated all feedback to date.

     

  • markgriffin's avatar
    markgriffin
    Icon for Nimbostratus rankNimbostratus
    Sep 08, 2017

    Many thanks Michael. Just used your iRule to fix a similar issue I was having. Worked a treat! :)