# iRule to block string in header and display blocking page

**URL:** <https://community.f5.com/t/irule-to-block-string-in-header-and-display-blocking-page/44201>\
**Category:** Technical Forums\
**Tags:** asm-irules, irules, asm-advanced-waf, f5irule, security\
**Created:** [April 13, 2017, 1:56pm UTC](https://community.f5.com/t/irule-to-block-string-in-header-and-display-blocking-page/44201 "2017-04-13T13:56:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![NickAD](https://avatars.discourse-cdn.com/v4/letter/n/54ee81/32.png) [@NickAD](https://community.f5.com/u/NickAD)\
**Post date:** [April 13, 2017, 1:56pm UTC](https://community.f5.com/t/irule-to-block-string-in-header-and-display-blocking-page/44201/1 "2017-04-13T13:56:31Z")

</div>

I am wondering if I can create an iRule to block a request if a certain string appears anywhere in the header.

For example, it would be something like…

```tcl
when HTTP_REQUEST {
if { [HTTP::header "User-Agent"] contains "test1234" } {
drop
return }
}

```

Except I would not want the block to be limited to the User-Agent. I would want it to be blocked no matter where “test1234” appeared in the header.

A follow-up to that would be if I can also have this iRule display the blocking page with a SupportID. I would like those testing to be able to have visual confirmation to see it worked and so they can easily share it with others.

---

<div class="post-metadata">

**Author:** ![Vijay\_E](https://avatars.discourse-cdn.com/v4/letter/v/4bbf92/32.png) [@Vijay\_E](https://community.f5.com/u/Vijay_E)\
**Post date:** [April 13, 2017, 6:39pm UTC](https://community.f5.com/t/irule-to-block-string-in-header-and-display-blocking-page/44201/2 "2017-04-13T18:39:45Z")

</div>

I have never tried this but you may be able to get something along this line working:

```tcl
when HTTP_REQUEST {
  foreach header_var [HTTP::header names] {
    if { [HTTP::header header_var] contains "test1234" } {
      drop
      return }
}
}

```

---

<div class="post-metadata">

**Author:** ![Snl](https://avatars.discourse-cdn.com/v4/letter/s/8797f3/32.png) [@Snl](https://community.f5.com/u/Snl)\
**Post date:** [April 14, 2017, 6:15pm UTC](https://community.f5.com/t/irule-to-block-string-in-header-and-display-blocking-page/44201/3 "2017-04-14T18:15:43Z")

</div>

Try below

```tcl
when HTTP_REQUEST {
   log local0. "[IP::client_addr]:[TCP::client_port]: User-Agent: [string tolower [HTTP::header "User-Agent"]] requested [HTTP::host][HTTP::uri]"
      if { [string tolower [HTTP::header "User-Agent"]] contains "test1234"} {
  log local0. "[IP::client_addr]:[TCP::client_port]: Rejected request"
  reject }}

```