iRule Security 101 - #02 - HTTP Methods and Cross Site Tracing
In this installment of iRule Security 101, I'll refer to OWASP's Data Validation Test "Testing for HTTP Methods and XST (Cross Site Tracing)" and illustrate how to use iRules to build a defense mecha...
Published Aug 13, 2007
Version 1.0
Nathan_McKay_67
Nimbostratus
NimbostratusHi, first let me say that I really enjoy these articles - please keep them coming.
However, I did note that the if statement in the above rule seems to be inverted when assessing whether or not to reject the connection. Assuming that we don't want to accept those HTTP methods, you probably want to drop the ! in the evaluation. Looks like maybe you were thinking to define only acceptable HTTP methods and simply drop everything else (which would seem like the best way to go about this - whitelisting is usually easier than blacklisting anyway). :-)