For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Tim_Cahoon_1608's avatar
Tim_Cahoon_1608
Icon for Nimbostratus rankNimbostratus
Jul 28, 2016

URI Rewrite Help - Rookie

I am trying to do something I think is very simple: when HTTP_REQUEST { HTTP::redirect /broker/api/public[HTTP::uri] }

 

I want to take an HTTP request coming in and put /broker/api/pubic in front of the URI that is received. I would prefer the client not see the result in their browser.

 

I have a profile with HTTP profile assigned to it and this IRULE. When I use the rule the code I'm inserting is repeated about 10 times. Help? This is on 11.6.1 on a virtual BIGIP.

 

The result in my browser when testing is: xyz.abc.com/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/broker/api/public/my/suff

 

application delivery
BIG-IP
iRules
security

10 Replies

  • Yann_Desmarest_'s avatar
    Yann_Desmarest_
    Icon for Nacreous rankNacreous
    Jul 28, 2016

    Hi,

    You can do the following : 

    when HTTP_REQUEST {
    if { !([HTTP::path] starts_with "/broker/api/public") } {
        HTTP::respond 302 Location "/broker/api/public[HTTP::uri]"
    }
}
    • Tim_Cahoon_1608's avatar
      Tim_Cahoon_1608
      Icon for Nimbostratus rankNimbostratus
      Jul 28, 2016

      Thank you Yann. that is doing what I need. One last question, is there a what to not let the client see the rewritten URI? I'd like them to see what they sent, and have the rewritten go to the server only. Any ideas on this?

       

      Once again thank you.

       

    • Yann_Desmarest_'s avatar
      Yann_Desmarest_
      Icon for Nacreous rankNacreous
      Jul 28, 2016

      Hi,

      The irule previously posted do a redirect on the client side. If you require to do URI rewriting, you will need to change the irule : 

      when HTTP_REQUEST {
    if { !([HTTP::path] starts_with "/broker/api/public") } {
        HTTP::uri "/broker/api/public[HTTP::uri]"
    }
}

      You may also have a look at the URI rewrite profile that has the advantage to rewrite response headers and payload to remove "/broker/api/public" for the client.

  • Yann_Desmarest's avatar
    Yann_Desmarest
    Icon for Cirrus rankCirrus
    Jul 28, 2016

    Hi,

    You can do the following : 

    when HTTP_REQUEST {
    if { !([HTTP::path] starts_with "/broker/api/public") } {
        HTTP::respond 302 Location "/broker/api/public[HTTP::uri]"
    }
}
    • Tim_Cahoon_1608's avatar
      Tim_Cahoon_1608
      Icon for Nimbostratus rankNimbostratus
      Jul 28, 2016

      Thank you Yann. that is doing what I need. One last question, is there a what to not let the client see the rewritten URI? I'd like them to see what they sent, and have the rewritten go to the server only. Any ideas on this?

       

      Once again thank you.

       

    • Yann_Desmarest's avatar
      Yann_Desmarest
      Icon for Cirrus rankCirrus
      Jul 28, 2016

      Hi,

      The irule previously posted do a redirect on the client side. If you require to do URI rewriting, you will need to change the irule : 

      when HTTP_REQUEST {
    if { !([HTTP::path] starts_with "/broker/api/public") } {
        HTTP::uri "/broker/api/public[HTTP::uri]"
    }
}

      You may also have a look at the URI rewrite profile that has the advantage to rewrite response headers and payload to remove "/broker/api/public" for the client.

  • Vernon_97235's avatar
    Vernon_97235
    Historic F5 Account
    Jul 28, 2016

    The problem is that you force a redirect, which causes the user-agent to re-request the page with the new Location value (that is, with /broker/... prepended). Because you perform no check, the client is redirected again, and /broker/... is prepended, again. This happens repeatedly until the UA decides that the Request-URI is too long.

     

    As @Yann says, you could check the Request-URI. However, because you don't want the new path to be "revealed" to the client, there is a simpler approach. Instead of sending a redirect (which is an HTTP Response message with a 3xx Response Code and a Location header pointing to the new resource path), simply change the Request-URI on the server-side of the proxy. The UA will never "see" the change and there is no direct redirect response sent. This is done thusly:

     

    when HTTP_REQUEST {
    HTTP::uri "/broker/api/public[HTTP::uri]"
}

    If a UA may directly request something starting with /broker/api/public, then you must place the check as @Yann does.

     

  • VernonWells's avatar
    VernonWells
    Icon for Employee rankEmployee
    Jul 28, 2016

    The problem is that you force a redirect, which causes the user-agent to re-request the page with the new Location value (that is, with /broker/... prepended). Because you perform no check, the client is redirected again, and /broker/... is prepended, again. This happens repeatedly until the UA decides that the Request-URI is too long.

     

    As @Yann says, you could check the Request-URI. However, because you don't want the new path to be "revealed" to the client, there is a simpler approach. Instead of sending a redirect (which is an HTTP Response message with a 3xx Response Code and a Location header pointing to the new resource path), simply change the Request-URI on the server-side of the proxy. The UA will never "see" the change and there is no direct redirect response sent. This is done thusly:

     

    when HTTP_REQUEST {
    HTTP::uri "/broker/api/public[HTTP::uri]"
}

    If a UA may directly request something starting with /broker/api/public, then you must place the check as @Yann does.