IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Question on Handling of Chunked Responses in WebSEAL

    Posted Wed May 14, 2025 09:34 AM

    We would like to understand how WebSEAL handles chunked responses.

    Does WebSEAL preserve the chunked response from the backend, or does it buffer the response and release it only once all chunks have been received?

    The global setting chunk-responses = yes is enabled. In our case, the junction is configured as a transparent path junction.

    Is it possible to control or configure chunked response behavior at the junction level?

    Can this be enabled for a specific junction, or even more selectively, without applying it globally?



    ------------------------------
    Banu Priya Gopalakrishnan
    ------------------------------


  • 2.  RE: Question on Handling of Chunked Responses in WebSEAL

    Posted Wed May 14, 2025 05:33 PM

    Banu,

     

    I am not 100% sure of how WebSEAL handles chunked responses, but strongly suspect that for virtual path junctions and virtual host junctions (i.e. junctions which do not require filtering of the response) the response body will be passed through WebSEAL as-is.  In other words, if WebSEAL receives a chunked response it will pass this same chunked response back to the client.

     

    This behaviour will be different for standard junctions as WebSEAL needs to filter the response (e.g. it rewrites embedded URLs to include the junction path).  The configuration entry which you mentioned (chunk-responses) is used by this filter to tell WebSEAL whether it should buffer the entire message that is being filtered (so that it can calculate the content-length header), or whether it should use chunked responses so that it does not need to calculate the content-length header.  This configuration setting is a global setting and cannot be set on a per junction basis.

     

    I hope that this helps.

     

    Scott Exton

    IBM Verify platform architect

    IBM Master Inventor

     

    1 Corporate Court, Bundall, QLD 4217.

    E-mail: scotte@au1.ibm.com

     




    Original Message


  • 3.  RE: Question on Handling of Chunked Responses in WebSEAL

    Posted Thu May 15, 2025 02:45 AM

    Hi Banu,

    You can set a POP with "Extended Attributes" "response-buffer-control = bypass". That way WebSEAL won't wait to receive the whole answer before forwarding to the client.

    We had to use this setting for certain URLs of OWA (Outlook), where they kept a control channel open.

    As it is a POP, it is quite flexible where you apply it. You can use DynURL to define the pattern.

    I hope this setting helps in your case.

    Kind regards,



    ------------------------------
    Laurent LA Asselborn
    ------------------------------

    Original Message


Related Content