Forum Discussion

Johan_Lång's avatar
May 05, 2021

Cors preflight requests problem

I have two different web applications that make requests to domain names other than themselves. For example, x.domain.com makes a request to y.domain.com to retrieve certain data. The user is authenticated through APM, and we are using a multidomain sso.

 

The problem is that when the request is sent, BIG-IP will make an redirect to /my.policy and finally to /my.logout.php3?errorcode=19.

 

I've tried the workaround with this irule: https://devcentral.f5.com/s/articles/cors-implementation but it does not solve the issue.

The APM still not allow the request to reach its destination.

 

My only workaround is to let these requests go to a "public VIP", only with ASM as protection, but I want it to go through APM and the same VIP as the original site that is already authenticated.

 

Thanks!

Johan

 

 

13 Replies

  • Hi Johan,

     

    Do I understand it correctly that the backend server of the first web application (the server hosting x.domain.com) needs to reach y.domain.com in order to gather some information it needs to complete a request for the client?

     

    If so, do you need that backend server to log in to the APM policy, or do you just need it to be able to reach the backend system? If you just need the backend system to gain access to the application, you could put in an agent in the APM policy BEFORE it gets to the login page? This agent can then check if the request is coming from a specific IP, or some other way in which you can identify that it is this server. If so, you can then bypass the login page and go straight through to the "Allow".

     

    Of course, do ensure there is no other way anyone could exploit that ;)

     

    Hope this helps.

     

     

    • Johan_Lång's avatar
      Johan_Lång
      Icon for Cirrus rankCirrus

      Hmm, not quite, I think.

       

      Isnt it the client who makes the acctual call to the backend server, y.domain.com?

      x.domain.com responds with a 302 to the client with a new location header and the client trying to make a new request to the new location?

       

      In your scenario, x.domain.com makes the acctual request to y.domain.com in the back, right?

      But if there is way to accomplish that instead, im in! :) but im not sure how to do that really..

       

      Best regards,

      Johan

      • AlexBCT's avatar
        AlexBCT
        Icon for Cumulonimbus rankCumulonimbus

        Hi Johan,

         

        Sounds like you are a step further at least! (just not with a working solution yet ;)

         

        It sounds to me that there may be some entries missing from the Authentication Domains settings. Can you confirm that the Auth Domains tab looks similar to this one:

         

         

         

        Also, in your reponse you mention a redirect to z.example.se - not sure if that is a typo and you mean z.example.COM or if this is a different domain, but either way ensure that this domain is also part of the Auth Domain list.

         

        Let me know how you get on!

    • Johan_Lång's avatar
      Johan_Lång
      Icon for Cirrus rankCirrus

      I can see now that my original question can be interpreted exactly as you did.

       

  • if you are using ASM it might be the culprit, check this:

     

    Bug ID 746394: With ASM CORS set to 'Disabled' it strips all CORS headers in response.

     

    https://cdn.f5.com/product/bugtracker/ID746394.html

     

    Also if y.domain.com where your request is landing has an ASM policy in blocking mode please do check that OPTIONS method is not blocked in ASM policy (it is blocked by default)

    • Johan_Lång's avatar
      Johan_Lång
      Icon for Cirrus rankCirrus

      Thanks for your reply, unfortunately we´re not using ASM together with APM.

      /Johan