For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Emad's avatar
Emad
Icon for Cirrostratus rankCirrostratus
May 14, 2015

Why Irules add Server Header in HTTP::respond and HTTP::redirect

As observed when ever I use HTTP::respond or HTTP::redirect for 302, LTM add server header in response i.e Server: BigIP. Is this a standard behavior and could this be changed. For Example Irule is. 

    when HTTP_REQUEST {
                HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
       }

And response is 

(Status-Line)   HTTP/1.0 302 Found
    Location        https://www.abc.com/
    Server      BigIP
    Connection      Keep-Alive
    Content-Length      0
application delivery
devops
iRules

3 Replies

  • Patrik_Jonsson's avatar
    Patrik_Jonsson
    Icon for MVP rankMVP
    May 14, 2015

    I believe it's there to make the troubleshooting easier and it might even be a standard since other web servers does this as well (IIS, Apache, Tomcat etc) You can probably remove it in the HTTP_RESPONSE event.

    Untested iRule: 

    when HTTP_REQUEST {
    HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
}


when HTTP_RESPONSE {

    if { [HTTP::is_redirect] && [HTTP::header value "Server"] == "BigIP" } {
        HTTP::header remove Server
    }

}

    /Patrik

  • sfuerst_116779's avatar
    sfuerst_116779
    Historic F5 Account
    May 14, 2015

    You can also change the Server-Agent-Name in the http profile to another string. (i.e. to match what your back-end webserver sends.) If the string is empty, then no server header will be added.

     

    This will affect all ways the BigIP will generate responses, not just iRules.