Irule help to block HTTP request if the HTTP Referer header value is null or with wrong domain

[Thiyagu]

Hello Team,

I'm in need of an Irule to block HTTP request if the HTTP Referer header value is null or with wrong domain address.

Could you please help with an irule for this request?

    when HTTP_REQUEST {

       set referer [string tolower [HTTP::header value "Referer"]]

       if {($referer != "") && !($referer starts_with "*.abc.com")} {

           log local0.info "Rejecting request to [HTTP::uri] with Referer $referer"

           reject

       }

   }

I have also tried the below irule and this also not worked.

Class allowed_referers {

      *.abc.com

}

when HTTP_REQUEST {

  set referer [string tolower [HTTP::header value "Referer"]]

  if { ( [matchclass [HTTP::header value "Referer"] $referer contains allowed_referers ] ) }

   {

     allow

  }

}

Regards,

Thiyagu

[Enes_Afsin_Al]

Hi Thiyagu,

* character is not wildcard in here.

Can you try that?

if {($referer ne "") && !($referer contains ".abc.com")}

[Thiyagu]

Hello aaa,

I have tried the below irule and it is not working. As far I know the the flow logic is correct and for some reason this irule is not working.

Could you please correct me if I' missing something here?

when HTTP_REQUEST

{

 set referer [string tolower [HTTP::header value "Referer"]]

     if {($referer ne "") && !($referer contains ".abc.com")}

     {

     HTTP::respond 400 content "Bad Request" "Content-Type" "text/html"

     }

 }

Regards,

Thiyagu

[Enes_Afsin_Al]

Hi Tiyagu,

Can you test this and investigate logs?

when HTTP_REQUEST {
	log local0. "referer status: [HTTP::header exists Referer] | clientip: [IP::client_addr] | uri: [HTTP::uri]"
	if { [HTTP::header exists "Referer"] and not ([HTTP::header value "Referer"] contains ".abc.com") } {
		log local0. "referer header found | uri: [HTTP::uri]"
		HTTP::respond 400 content "Bad Request" Content-Type "text/html"
	}
}

[Thiyagu]

Thanks a lot eaa.

As a plan B I have also worked on the below iRULE. Could you please correct me if I' missing something ?

------------------------------------------------

when HTTP_REQUEST {

 switch -glob [HTTP::header "Referer"] {

   "*.abc.com/*" {

     # Allow Request to go through...

   }

   "" {

     HTTP::respond 400 content "Bad Request" Content-Type "text/html"

   }

   default {

    HTTP::respond 400 content "Bad Request" Content-Type "text/html"

   }

 }

}

------------------------------------------------------------

Thanks a lot in advance

Regards,

Thiyagu