Forum Discussion

Brent_Sachnoff_'s avatar
Brent_Sachnoff_
Icon for Nimbostratus rankNimbostratus
Dec 13, 2006

Serverside redirects

Our network setup consists of a F5 and 3 web servers all in the same pool. We terminate SSL on the F5 which means we are just doing http on the serverside. We recently started to do server side redirects which forces the redirect to hit the pool again and goto another server. This causes all kinds of issues due to the various cookies that our app is looking for and can not longer find because when they hit the new server, it looks like a new session.

 

 

I was looking at doing something with HTTP_RESPONSE and comparing the uri being generated on the serverside with our problem uri. If it matches I would send it back to the same server. It seems I can not use HTTP::uri with HTTP_RESPONSE.

 

 

What is everyone else doing in this scenario? Any iRule snippets out there that might give me some more direction?
application delivery
dev
devops
iRules
  • Deb_Allen_18's avatar
    Deb_Allen_18
    Historic F5 Account
    Dec 13, 2006
    The server-generated redirect URI is contained in a server response header, so rather than using [HTTP::uri], you can use [HTTP::header] to catch and manipulate the Location: header within the HTTP_RESPONSE event:
    when HTTP_RESPONSE {
  if { [HTTP::header exists Location] }{
    set myNewRedirect 
    HTTP::header replace Location $myNewRedirect
  }
}
    However, you might want to experiment with a persistence profile instead of an iRule to solve the problem.  Persistence is easy to implement.  Cookie persistence is low overhead, and would work if redirects are to the same server name.
HTH
/deb
  • Brent_Sachnoff_'s avatar
    Brent_Sachnoff_
    Icon for Nimbostratus rankNimbostratus
    Dec 13, 2006
    Thanks for the quick response Deb.

     

     

    That looks like it will solve my problem.

     

     

    I do have persistence profile for SSL but not for normal HTTP. My problem is the our code sends back all responses on HTTP and I use the F5 to force it back to HTTPS. I do not know how to implement persistence across the board for HTTP or HTTPS as both are different VIPs. Suggestions on that?
  • Deb_Allen_18's avatar
    Deb_Allen_18
    Historic F5 Account
    Dec 13, 2006
    If the hostname is the same for both HTTP and the subsequent redirect to HTTPS, the browser should submit the cookie when following the redirect.

     

     

    If it's a redirect to a different name, you could implement simple/sourceIP persistence and enable "Match across virtual servers".

     

     

    In addition to persistence, there is a setting in the HTTP profile called "Redirect rewrite" that will enable automatic re-writing of server-set redirects to HTTPS when LTM is doing decryption. Create and apply a custom http profile with Redirect rewrite set to "Matching" to force re-writing of HTTP redirects for the requested hostname to HTTPS.

     

     

    You can also apply this iRule to the HTTP virtual server to force traffic from HTTP to HTTPS: Click here

     

     

    I think that should take care of everything...

     

     

    HTH

     

    /deb