Forum Discussion

insomniak_11745's avatar
insomniak_11745
Icon for Nimbostratus rankNimbostratus
Aug 19, 2013

Restrict Access via HTTP referer

I'm attempting to restrict access to an application via HTTP REFERER. Using the example given by the dev team, I'm using something that looks like this: when HTTP_REQUEST { switch -glob [HTTP::...
application delivery
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Aug 19, 2013

Also note that if a browser goes from https:// to http:// it will not send a Referrer header. So your blacklisted site could easily get around the iRule logic if they use https:// on their site.

 

http://tools.ietf.org/html/rfc2616section-15.1.3

 

Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.

 

Aaron