Applies To:

Show Versions Show Versions

Manual Chapter: Extracting Dynamic Session Information from URLs
Manual Chapter
Table of Contents   |   << Previous Chapter

In this implementation, we describe several regular expressions that you can use to remove dynamic session information from URLs. When you enable the Dynamic Sessions in URL setting, in the web application properties, the system treats each request for a web object with dynamic session information as a request for the same web object. For more information on the Dynamic Sessions in URL setting, refer to Enabling dynamic sessions in URLs, in the Working with Web Applications chapter of the Configuration Guide for BIG-IP® Application Security Management.
Important: When the system extracts dynamic session information, it applies the regular expression that you configure only to the URI, and not the query string. In other words, the system applies the regular expression up to, but not including, the question mark (?) character in the URI.
In this example, we want the Application Security Manager to disregard dynamic directory information in the URI. In the example URI in Figure 7.1, the dynamic directory information is /any_text/END1/any_dir/END. You can remove all or part of the dynamic directory information, as explained in the following tasks.
In this task, the regular expression we provide causes the system to extract the dynamic directory information /any_text/END1/any_dir/END from the example URI, and leaves only the web object /sell.php.
1.
On the Main tab of the Application Security navigation pane, expand Application Security, and then click Web Applications.
The Web Applications screen opens.
2.
In the Name column, click a web application name.
The Web Application Properties screen opens.
3.
In the Web Application Properties section, for the Dynamic Sessions in URL setting, select Custom pattern.
The screen refreshes, and displays additional configuration settings.
4.
In the Value box, type the following regular expression:
5.
In the Description box, type an optional description of the regular expression.
6.
Click Update.
The system updates the configuration with any changes you have made.
In this example, the regular expression we provide causes the system to extract only /any_text/END1 from the example URI shown in Figure 7.1. The system adds the resulting web object, /sell.php/any_dir/END, to the security policy.
1.
On the Main tab of the Application Security navigation pane, expand Application Security, and then click Web Applications.
The Web Applications screen opens.
2.
In the Name column, click a web application name.
The Web Application Properties screen opens.
3.
In the Web Application Properties section, for the Dynamic Sessions in URL setting, select Custom pattern.
The screen refreshes, and displays additional configuration settings.
4.
In the Value box, type the following regular expression:
5.
In the Description box, type an optional description of the regular expression.
6.
Click Update.
The system updates the configuration with any changes you have made.
In this example, we want the Application Security Manager to disregard Java® session ID information for an object. In the example URI shown in Figure 7.2, the Java session ID information is ;jsessionid=12345678901234567890123456789012, and the object is /forum.jsp.
1.
On the Main tab of the Application Security navigation pane, expand Application Security, and then click Web Applications.
The Web Applications screen opens.
2.
In the Name column, click a web application name.
The Web Application Properties screen opens.
3.
In the Web Application Properties section, for the Dynamic Sessions in URL setting, select Custom pattern.
The screen refreshes, and displays additional configuration settings.
4.
In the Value box, type the following regular expression:
5.
In the Description box, type an optional description of the regular expression.
6.
Click Update.
The system updates the configuration with any changes you have made.
Table of Contents   |   << Previous Chapter

Was this resource helpful in solving your issue?




NOTE: Please do not provide personal information.



Incorrect answer. Please try again: Please enter the words to the right: Please enter the numbers you hear:

Additional Comments (optional)