cancel
Showing results for 
Search instead for 
Did you mean: 

irule to replace Realm value for http response header WWW-Authenticate: Basic realm="IP address"

alchancco
Nimbostratus
Nimbostratus

To mitigate against internal IP address disclosure in Basic Authentication Header, i'd like to change the IP address to some other value.

I tried changing "Basic Auth Realm" in http profile but it only works for some testing tools like wfetch but not for curl.

I also tried the following irule but it also works sometimes:

when HTTP_RESPONSE {

if { [HTTP::header "WWW-Authenticate"] starts_with "Basic" }{
HTTP::header replace WWW-Authenticate "Basic realm='mydomain.com'"
}
}

2 REPLIES 2

Hi alchancco,

Can you change the http event and try?

when HTTP_RESPONSE_RELEASE {
	if { [HTTP::header WWW-Authenticate] starts_with "Basic" }{
		HTTP::header replace WWW-Authenticate "Basic realm='mydomain.com'"
	}
}

 

HI Enes_Afsin_AI,

I made the change  but as before it only changes the header value  sporadically.

- alfredo