Forum Discussion

alchancco's avatar
alchancco
Icon for Nimbostratus rankNimbostratus
Jul 08, 2022

irule to replace Realm value for http response header WWW-Authenticate: Basic realm="IP address"

To mitigate against internal IP address disclosure in Basic Authentication Header, i'd like to change the IP address to some other value.

I tried changing "Basic Auth Realm" in http profile but it only works for some testing tools like wfetch but not for curl.

I also tried the following irule but it also works sometimes:

when HTTP_RESPONSE {

if { [HTTP::header "WWW-Authenticate"] starts_with "Basic" }{
HTTP::header replace WWW-Authenticate "Basic realm='mydomain.com'"
}
}

2 Replies

  • Hi alchancco,

    Can you change the http event and try?

    when HTTP_RESPONSE_RELEASE {
    	if { [HTTP::header WWW-Authenticate] starts_with "Basic" }{
    		HTTP::header replace WWW-Authenticate "Basic realm='mydomain.com'"
    	}
    }

     

    • alchancco's avatar
      alchancco
      Icon for Nimbostratus rankNimbostratus

      HI Enes_Afsin_AI,

      I made the change  but as before it only changes the header value  sporadically.

      - alfredo