For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Michael_108224's avatar
Michael_108224
Icon for Nimbostratus rankNimbostratus
Sep 05, 2014

test for http response header, if not there set one

the senario is, the webserver sometimes "forgot" to set http header. I would like a irule witch first is checking if the http header is ther. If the header is present (dont change). If the header is not the, insert a default value.

 

like : when HTTP_RESPONCE {

 

test for the present of http header : Access-Control-Allow-Credentials Access-Control-Allow-Headers Access-Control-Allow-Origin

if they have a value = do nothing. if they do not then : HTTP::header insert Access-Control-Allow-Credentials "true" HTTP::header insert Access-Control-Allow-Headers "" HTTP::header insert Access-Control-Allow-Origin ""

 

end

 

application delivery
devops
iRules
LTM

8 Replies

  • Vitaliy_Savrans's avatar
    Vitaliy_Savrans
    Icon for Nacreous rankNacreous
    Sep 05, 2014

    Hi,

    you can use something like this:

    when HTTP_RESPONSE {
if  !{[HTTP::header exists "Access-Control-Allow-Credentials"]} {
HTTP::header insert Access-Control-Allow-Credentials "value"
}
}
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Sep 05, 2014

    i think exclamation mark (!) should be inside curly brackets.

    e.g.

     config

[root@ve11a:Active:In Sync] config  tmsh list ltm rule qux
ltm rule qux {
    when HTTP_RESPONSE {
  if { ![HTTP::header exists "Access-Control-Allow-Credentials"] } {
    HTTP::header insert "Access-Control-Allow-Credentials" "true"
  }

  if { ![HTTP::header exists "Access-Control-Allow-Headers"] } {
    HTTP::header insert "Access-Control-Allow-Headers" ""
  }

  if { ![HTTP::header exists "Access-Control-Allow-Origin"] } {
    HTTP::header insert "Access-Control-Allow-Origin" ""
  }
}
}

 test

[root@ve11a:Active:In Sync] config  curl -I http://172.28.24.10
HTTP/1.1 200 OK
Date: Fri, 05 Sep 2014 11:06:09 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Sun, 09 Feb 2014 08:39:51 GMT
ETag: "41879c-59-2a9c23c0"
Accept-Ranges: bytes
Content-Length: 89
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers:
Access-Control-Allow-Origin:
  • nitass_89166's avatar
    nitass_89166
    Icon for Noctilucent rankNoctilucent
    Sep 05, 2014

    i think exclamation mark (!) should be inside curly brackets.

    e.g.

     config

[root@ve11a:Active:In Sync] config  tmsh list ltm rule qux
ltm rule qux {
    when HTTP_RESPONSE {
  if { ![HTTP::header exists "Access-Control-Allow-Credentials"] } {
    HTTP::header insert "Access-Control-Allow-Credentials" "true"
  }

  if { ![HTTP::header exists "Access-Control-Allow-Headers"] } {
    HTTP::header insert "Access-Control-Allow-Headers" ""
  }

  if { ![HTTP::header exists "Access-Control-Allow-Origin"] } {
    HTTP::header insert "Access-Control-Allow-Origin" ""
  }
}
}

 test

[root@ve11a:Active:In Sync] config  curl -I http://172.28.24.10
HTTP/1.1 200 OK
Date: Fri, 05 Sep 2014 11:06:09 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Sun, 09 Feb 2014 08:39:51 GMT
ETag: "41879c-59-2a9c23c0"
Accept-Ranges: bytes
Content-Length: 89
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers:
Access-Control-Allow-Origin:
    • Vitaliy_Savrans's avatar
      Vitaliy_Savrans
      Icon for Nacreous rankNacreous
      Sep 05, 2014
      i think exclamation mark (!) should be inside curly brackets. Thanks that was my mistake
  • Michael_108224's avatar
    Michael_108224
    Icon for Nimbostratus rankNimbostratus
    Sep 05, 2014

    thanks for your ideer. I have modified it a littel, trying to make it fit my vhost irule like :

     

    switch $vhost { "domain1" { HTTP::version "1.1" HTTP::header remove Server } "domain2" { if !{[HTTP::header exists "Access-Control-Allow-Headers"]} { HTTP::header insert Access-Control-Allow-Headers "" } if !{[HTTP::header exists "Access-Control-Allow-Origin"]} { HTTP::header insert Access-Control-Allow-Origin "" } if !{[HTTP::header exists "Access-Control-Allow-Credentials"]} { HTTP::header insert Access-Control-Allow-Credentials "true" } } }

     

    but I get this error in /var/log/ltm :

     

    warning mcpd[7640]: 01071859:4: Warning generated : /Common/town-multi:518: warning: [use curly braces to avoid double substitution][!{[HTTP::header exists "Access-Control-Allow-Headers"]}] /Common/town-multi:521: warning: [use curly braces to avoid double substitution][!{[HTTP::header exists "Access-Control-Allow-Origin"]}] /Common/town-multi:524: warning: [use curly braces to avoid double substitution][!{[HTTP::header exists "Access-Control-Allow-Credentials"]}]

     

    but it seemes to work....