16-Jan-2021 23:42
Customer has an application that they want access only through the mobile device app.
They have recently found that the application can be accessed through any browser.
We have configured the following iRule but it is not working:
when HTTP_REQUEST {
if { ([HTTP::header User-Agent] contains "iphone") or ([HTTP::header User-Agent] contains "Android") } {
HTTP::redirect http://www.oursite.com}
if { ([HTTP::header User-Agent] contains "(IE|Mozilla|Safari|Chrome|Opera)") } {
drop
}
}
Any ideas how to achieve this?
Thanks
18-Jan-2021
23:31
- last edited on
04-Jun-2023
21:06
by
JimmyPackets
Hi Alfonso,
this iRule should work. However I strongly discourage the use of it. User-Agent Headers can be forged easily. Anyone who knows how to access Developer Tools in a browser can change his User-Agent string to whatever they want.
when HTTP_REQUEST {
if {([string tolower [HTTP::header "User-Agent"]] contains "iphone") || ([string tolower [HTTP::header "User-Agent"]] contains "android") } {
return
} else {
reject
}
}
18-Jan-2021 23:58
Hello Daniel,
Thanks for your reply. Will try this out but gave caution to customer as well.
What do you suggest how best to go about this requirement - allow only the access through mobile app (iPhone and Android) ?
19-Jan-2021 01:07
Without knowing much about the app and the setup (does the customer have APM maybe?) it is difficult to provide a good answer.
Maybe client certificate validation, which can be configured in the client-side SSL profile, could be a better solution?
20-Jan-2021 08:42
I assume even with APM, its still going to check the user-agent variable & thats going to validate against if it contains "iPhone" or "android" as such. I think WAF would have this advanced detection.
But if the requirement is to allow mobile users alone, then the Irule should work. Anyone who knows to tamper the header, can still get the data.
Is the application internal or external facing ?