For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

asamadyar's avatar
asamadyar
Icon for Nimbostratus rankNimbostratus
Apr 11, 2022

Remove values of a response header

Hi everybody, I need to remove the values of a response header. For example: access-control-allow-headers    ----->  X-Request-UUID, X-Web-Optimize-Response, X-Web-Client-Id, X-Web-City-Id, X-Web-C...
application delivery
security
Dario_Garrido's avatar
Dario_Garrido
Icon for Noctilucent rankNoctilucent
Apr 13, 2022

Hello Asamadyar.

If the header is located in the Response, you could remove it with next iRule.

when HTTP_RESPONSE
	HTTP::header remove "X-Web-City-Id"
}

Take into account that you would need a HTTP profile applied.

 

asamadyar's avatar
asamadyar
Icon for Nimbostratus rankNimbostratus
Apr 14, 2022

Many thanks, Dario_Garrido 

I don`t want to remove the header; I need to remove one value.

header ------------------------------------------- value

x-x-x                                                       t1, t2, t3, t4, t5

 

And I need to remove, for example, "t3" and keep everything intact in the response header.

I think your code will completely remove the header (x-x-x).

  • Dario_Garrido's avatar
    Dario_Garrido
    Icon for Noctilucent rankNoctilucent
    Apr 19, 2022

    Hello Asamadyar.

    Try with this code

     

    when HTTP_RESPONSE {
	if { [HTTP::header "access-control-allow-headers"] ne "" } {
		if { [HTTP::header "access-control-allow-headers"] contains "," }{
			set acheaders [split [HTTP::header "access-control-allow-headers"] ","]
			set output ""
			foreach acheader $acheaders {
				if { $output eq "" } {
					if { !($acheader contains "X-Web-City-Id") } { set output "$acheader" }
				} else {
					if { !($acheader contains "X-Web-City-Id") } { set output "$output,$acheader" }
				}
			}
			#log local0. "INPUT: [HTTP::header "access-control-allow-headers"]"
			HTTP::header replace "access-control-allow-headers" $output
			#log local0. "OUTPUT: [HTTP::header "access-control-allow-headers"]"
		}
	}
}