chatgpt sent 403 forbidden response code when client access via sslo

[neeeewbie]

Hi guys 

I need your help ! 

chatgpt sent 403 forbidden response code when client access via sslo

I guess chatgpt API connection can't established becuase of proxy setting 

please let me know the reason

thank you

[buulam]

@neeeewbie has the auth already happened? Do you have a capture without SSLO?

[neeeewbie]

working well when I configure bypass destination IP (chatgpt ip address)
but our customer wnat to see the all packet  

[buulam]

I think the site leverages OAuth. Are you able to tell if the login is passing through?

[neeeewbie]

Yes login is working well without bypassing

but when I start chat, error message occurred

I found some documents, that is indicate chatgpt make API token. I guess F5 can't make API connection because of token 

thank you

[buulam]

Yes, I think if you can get a capture without SSLO inline or bypassed, you can see where the token is lost or if that part just breaks

[neeeewbie]

thank you !! 
I will check this ! 

[sugiyama_san]

Hi !

Has this problem been resolved?

I am experiencing the same problem in my environment.

Logging in is fine, but when I first send the chat, I get an error.
I do not want to use bypass because I want to decrypt the communication to ChatGPT for information leakage prevention monitoring.

We are looking for a way to tune it so that it can be done without bypassing.

Questionably, it failed in Microsoft Edge, Google Chrome, and was usable in Firefox.

We are currently building a verification environment and will investigate.

[neeeewbie]

Hi 

I got documents about that

chatgpt using http2.0 

so we need enable http2.0

please check below url

https://my.f5.com/manage/s/article/K32080520

unfortunately I have another problem.. template Lx package does not work after 16.1.0 .. this configuration need over the 16.1.0 os version

thank you 

[sugiyama_san]

Hi !

Thanks for the information.

We are using Version 16.1 or later and will give it a try.

thank you.

[LiefZimmerman]

@neeeewbie and/or @sugiyama_san - is there one or more replies that you may Accept As Solution? Seems like the thread may not be done but...even a partial solution (or further update?) could help future users trying to leverage ChatGPT.
Thanks, Lief

[neeeewbie]

firefox browser user can access the chatGPT without http2 profile

other browser need http2 profile

[sugiyama_san]

Hi @neeeewbi and @LiefZimmerman

Sorry for the delayed response. I have checked to ensure that there are no issues with the actual modifications made.

I created a verification environment that closely resembles the actual service provision,
and after applying the settings,
I was able to confirm that it worked as expected, and ChatGPT was available for use.

made the following changes to the 'Client Profile' used in the 'SSL Configuration'.

Bigip Ver 16.1  (SSLo Ver 9.3)

SSL Forward Proxy > Hello Extensions
Extentions List...
Application-Layer Protocol Negotiation Enable

Thanks!!

[buulam]

Hey @neeeewbie did you happen to get a chance to try this?

[Kevin_Stewart]

Late to the scene...

Officially, ChatGPT through SSLO requires HTTP/2. The Proxy ALPN option was added in SSLO 9.0: https://clouddocs.f5.com/sslo-deployment-guide/sslo-09/chapter1/page1.02.html

[LiefZimmerman]

Thanks @Kevin_Stewart - your expertise is always appreciated.
@neeeewbie - can you mark one or more of these as Solutions?

[sugiyama_san]

Hi @Kevin_Stewart

The configuration I'm using in my SSLo involves decrypting HTTPS traffic, forwarding it to an explicit proxy (McAfee Web Gateway) for security inspection, and then re-encrypting it.

Enabling the ProxyALPN option allowed me to use the desired ChatGPT. However, all the traffic using HTTP/2 to communicate ceased flowing to the explicit proxy on the SSLo service chain side.

Is there a way to resolve this issue and restore the flow of traffic using HTTP/2 to the explicit proxy within the SSLo service chain?

[Kevin_Stewart]

HTTP/2 to an inline HTTP inspection device is not supported.

[sugiyama_san]

Hi @Kevin_Stewart

Thank you for your response.