base on HTTP header irules to blocked request

[Chen_Zhe]

Hi,

Demand background：

Each request must contain at least one of the four header （has configed at Application Security : Headers : HTTP Headers）

access-token

authentication

authorization

token

my bad rules:

if { [HTTP::host] == "abc.com" || [HTTP::host] == "123.biz" } {

  if {[class match [HTTP::uri] contains meeting] and [ASM::violation names] eq "VIOLATION_MISSING_MANDATORY_HEADER" and [llength [ASM::violation details]] < 12} {

  ASM::unblock

   log local0.info "[HTTP::host] [HTTP::uri] and [llength [ASM::violation details]] and [ASM::violation details] and [ASM::violation names]"

  }

}

log output:

Rule /Common/authentication_header_url_check <ASM_REQUEST_DONE>: 

abc.biz 

/dealerUser/auth/login and 5 and {viol_index 64} {viol_name VIOL_MANDATORY_HEADER} {header_data.header_name access-token} {header_data.header_name authentication} 

{header_data.header_name token} and 

VIOLATION_MISSING_MANDATORY_HEADER

It based on violation names number,Cannot match actual demand。 who has good idea,thanks a lot.

[Ivan_Chernenkii]

Hello Chen Zhe,

What are you trying to achieve? If you want to block all requests which don't contains any of these 4 headers, then it would be better just create such rule in iRule or you can create attack signature with such rule (e.g content:!"access-token"; nocase; content:!"authentication"; nocase;....)

Thanks, Ivan

[Chen_Zhe]

Hi Ivan,

thank you!

Achieve you guess is right,detail: block all request which don't contains any of these 4 headers,unless shome HOST or host+uri .

but,rules didn't work as I expected。

when hit whilelist fist,at the end rules it hit discard again.​

when HTTP_REQUEST {

 if {[HTTP::header exists token] or [HTTP::header exists access-token] or [HTTP::header exists authentication] or [HTTP::header exists authorization]}{

   ASM::enable "/Common/base-on-header-string"

 }

#following all fuction is whitelist.

if { [class match [HTTP::host] contains domain_whiltlist] } {

 ASM::enable "/Common/base-on-header-string"

 }

 if { [HTTP::host] == "meetingroomip-uat.bba-app.com" || [HTTP::host] == "meeting-inspection.bba-app.biz" } {

   if {[class match [HTTP::uri] contains meeting] } {

   ASM::enable "/Common/base-on-header-string"

  }

 }

 if { [HTTP::host] == "bestyou-uat.bba-app.com" || [HTTP::host] == "bestyou.bba-app.biz" } {

   if { [class match [HTTP::uri] contains bestyou] } {

   ASM::enable "/Common/base-on-header-string"

  }

 }

else{

discard

}

[Ivan_Chernenkii]

I didn't get your further "whitelist" part...

Do you want not enforce in case of whitelist?.. then you need ASM: disable.

Also, you have

when HTTP_REQUEST {

 if {[HTTP::header exists token] or [HTTP::header exists access-token] or [HTTP::header exists authentication] or [HTTP::header exists authorization]}{

   ASM::enable "/Common/base-on-header-string"

 }

which means apply ASM policy in case of at least one header exists... While AFAIU you didn't want to block it. Please, clarify.

[Chen_Zhe]

thank you for your reply, forgot it.

I changed irules to meet the requirements, but I encountered problems related to if, elseif, else. and i asked new question.