For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

SANTHOSHKUMAR_S's avatar
SANTHOSHKUMAR_S
Icon for Nimbostratus rankNimbostratus
Jul 14, 2016

Redirect rewrite is not working

I have enabled Redirect rewrite on HTTP profile for all , still i see HTTP header as response on client browser . How to modify server response as HTTPS . Before it sent to client

GET /cc/Start.do HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, _/_
Referer: https://smart-np.applications.com/cc/
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET CLR 1.1.4322; .NET4.0C; .NET4.0E; MS-RTC LM 8)
Accept-Encoding: gzip, deflate
Host: smart-np.applications.com/cc/
DNT: 1
Connection: Keep-Alive
Cookie: csrfToken=b292bc3191b48cadb56fb9e62fc15cb7b1083e4d; JSESSIONID=eYK14gy8DmP3o5BAQ77fQyR1

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: no-cache
Cache-Control: no-store
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Content-Type: text/html;charset=utf-8
Content-Length: 121
Date: Thu, 14 Jul 2016 07:48:25 GMT
application delivery
LTM

2 Replies

  • IanB's avatar
    IanB
    Icon for Employee rankEmployee
    Jul 14, 2016

    The rewrite profile only looks at the HTTP headers. That is to say, if your webserver sends a 302 redirect to http://something, it will rewrite that to be https://something

    It doesn't touch the content of the page, only the headers.

    To modify the content, you need to use a STREAM profile and irule. For an example, refer to the article here.

    Note that if the content being returned from the webserver is gzip compressed, the BigIP will not magically decompress it, alter the content, recompress it, and send it on, so you need to remove or modify the Accept-Encoding header in the request to prevent the webserver using compression, so that the BigIP gets to see it.

    Generally speaking, the best solution for this is to fix the webserver, and not use a stream profile at all. Make sure that the webserver returns relative links wherever possible.

    So in your example, the best solution would be to update the webserver so that it returns a relative URL, rather than an absolute one.
  • janholtz_40468's avatar
    janholtz_40468
    Icon for Nimbostratus rankNimbostratus
    Aug 03, 2016

    Are you sure about that capture?

        ***Host: smart-np.applications.com/cc/***

    Is not RFC compliant, you are allowed a name and optionally a port ... URI's, not so much...