Forum Discussion
Antonio_Varni
Nimbostratus
Nimbostratusreplace all instances of a HTTP header
How can I replace all instances of a given header?
Specifically in my case I am trying to remove all previously set X-Forwarded-For headers before having the LTM inject it's own. The X-Forwarded-For HTTP profile does not do this - it just appends it's own.
An iRule approach I tried was this:
when HTTP_REQUEST {
HTTP::header replace X-Forwarded-For [IP::remote_addr]
This works if there is only 1 previously set X-Forwarded-For header - it replaces it with it's own.
You see - our application server only uses the first encountered X-Forwarded-For header and ignores the rest.
I can also write an iRule that deletes X previous copies of X-Forwarded-For before injecting it's own. But - an attacker only needs to specify X+1 headers to effectively spoof/mask their source IP address from our application's perspective.
A recursive iRule maybe? Or am I missing something basic?
I may need to find an application fix for this as I can at this point guarantee that the _last_ set X-Forwarded-For header is legit.
running 9.2.3
TIA
hoolioCirrostratus
Deb posted a nice solution for this a while back:when HTTP_REQUEST { strip all instances of the given header while {[HTTP::header exists x-forwarded-for]}{ HTTP::header remove x-forwarded-for } }
Aaron
Antonio_Varnithank you - perfect solution.
Shane_Terrick_9I know this is an old question but with Deb's answer does that put the source IP in the header instead of the the F5 device
- Kevin_Stewart
Employee
The iRule removes the XFF header from the request. The source address is not usually in an HTTP header unless you inject something like this XFF header. The source address still exists at the device though, at a lower OSI layer.
TD_DSS_116260I use the below rule and successfully end up with our clients IP address. This will check for any pre-existing XFF, remove it, and then add the IP of the incoming request. It's a bit wasteful (why not just wipe out the XFF regardless of if it is there or not?) though.
when HTTP_REQUEST { if {[HTTP::header exists X-Forwarded-For]} { HTTP::header remove X-Forwarded-For HTTP::header insert X-Forwarded-For [IP::remote_addr] } else { HTTP::header insert X-Forwarded-For [IP::remote_addr] }}
