Hi all,

I noticed, that when I use "https://www.google.com" as reaction in a rate limit policy then it doesn't work. In the log I can see the action:

2019-05-14-12:37:48.317+02:00I----- thread(5) trace.pdweb.http.ratelimit:3 /build/isam/src/i4w/pdweb/webseald/http/ratelimit/RateLimit.cpp:341: Bucket is full 16160466201027565576

2019-05-14-12:37:48.317+02:00I----- thread(5) trace.pdweb.http.ratelimit:5 /build/isam/src/i4w/pdweb/webseald/http/ratelimit/RateLimit.cpp:351: RATELIMIT_MGMT url: https://www.google.com

2019-05-14-12:37:48.317+02:00I----- thread(5) trace.pdweb.http.ratelimit:3 /build/isam/src/i4w/pdweb/webseald/http/ratelimit/RateLimit.cpp:465: ---RateLimiting end---

But there is no localtion header in 304 message:

HTTP/1.1 304 Not Modified
content-length: 0
date: Tue, 14 May 2019 11:34:14 GMT
p3p: CP="NON CUR OTPi OUR NOR UNI"
server: WebSEAL/9.0.6.0
strict-transport-security: max-age=31536000; includeSubDomains

It looks like action can be only a relative path, not any url. Is it by design?

Regards

------------------------------
Ivan Yartsev
------------------------------

Ivan,

Your guess is correct; the rewrite URL has to be a server-relative URL.

This is by design.  We are not sending a redirect to this URL (a REST client likely wouldn't like that anyway) - we are simply rewriting the request to be the new URL and then processing it as normal.  The Proxy can only handle a URL which is local so it makes sense that it is server relative.

If client is a browser and you want to redirect to another place, I think you could do this by hosting a page on the Reverse Proxy which simply does a JavaScript redirect (or maybe even a 302 redirect using template-page scripting) and then using this page as the rewrite URL.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------