I would love to receive your help to create an irule allowing me to modify the response code (with a 500) of the blocking page of ASM when an illegal request is matched.
The goal is not to modify the global response page that's why I want to do it in an irule so that this behavior happen only for on VS and not the other (which all use the same ASM policy).
30-Aug-201905:34 - last edited on 01-Jun-202314:47 by JimmyPackets
Hi,
iFile (asm_custom_response):
<html>
<head>
<title>Request Rejected</title>
</head>
<body>
The requested URL was rejected. Please consult with your administrator.<br><br>
Your support ID is: $supportid <br><br><a href='javascript:history.back();'>[Go Back]</a>
</body>
</html>
iRule:
when HTTP_REQUEST {
set asmstatus "allowed"
}
when ASM_REQUEST_BLOCKING {
set asmstatus "blocked"
set supportid [ASM::support_id]
}
when HTTP_RESPONSE_RELEASE {
# log local0. "ASM Status = $asmstatus"
if { $asmstatus equals "blocked" } {
# log local0. "Support ID = $supportid"
HTTP::respond 500 content [subst -nocommands -nobackslashes [ifile get asm_custom_response]]
}
}
06-Sep-201905:05 - last edited on 01-Jun-202314:46 by JimmyPackets
when ASM_REQUEST_BLOCKING {
set blocked 1
set response [ASM::payload]
}
when HTTP_RESPONSE_RELEASE {
catch {
if { $blocked } {
HTTP::respond 500 content $response
}
}
}
Something like this should work. The "catch" to prevent errors for not-blocked requests may be a bit crude. The thing eaa did with setting the indicator for all requests may be better. But this is shorter. I don't know, I'm not a programmer.
