Forum Discussion

Andre-Germany's avatar
Andre-Germany
Icon for Nimbostratus rankNimbostratus
Mar 15, 2019

Allowed URL with Parameter

Hello, everybody,

 

I have inferential problem. I have two URLs, one should be allowed and the other should not be allowed.

 

/prweb/*/!STANDARD?pyActivity= --> allowed

 

/prweb/*/!STANDARD --> not allowed

 

Now the F5 only recognizes the first part as URL and not the parameter. How can I get it that only the URL with the parameter can be called?

 

Already entered the parameter at the URL. But I can call both URLs.

 

Does anyone have an idea?

 

Thanks Udo

 

ASM Advanced WAF
iRules
security

2 Replies

Sort By
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Mar 15, 2019

    In ASM, there is no rule to deny url without parameter but only defining allowed parameters...

    If you want to do it, you have to write an irule...

    when HTTP_REQUEST { 
    if {!([string match [HTTP::path] "/prweb/*/!STANDARD"] && [HTTP::query] starts_with "pyActivity")} {    
        drop        
    }    
}

    You can also do it within a LOCAL TRAFIC POLICY with same logic

  • Andre-Germany's avatar
    Andre-Germany
    Icon for Nimbostratus rankNimbostratus
    Mar 19, 2019

    I just built it.

     

    Now I also get an Arlam when calling the page with the parameter.