Security Header too long http 1.0

You must decrypt the HTTPS using a client SSL profile in order to inspect/modify the HTTP content. Be aware that the maximum header size in the HTTP profile does not affect the actual requests/responses. The value is just used to determine how many bytes to allocate for buffering header values. The online help shows this:

Maximum Header Size

Specifies the maximum amount of HTTP header data that the system buffers before making a load balancing decision. The default is 32,000 bytes.

If you want to modify LTM's handling of long headers, you could use an iRule. Of course, this assumes the traffic is either HTTP or decrypted HTTPS.

(Modified from http://devcentral.f5.com/Default.aspx?tabid=53&forumid=5&tpage=1&view=topic&postid=32156)

 
 when HTTP_REQUEST { 
  
     Loop through each header name 
    foreach header {[HTTP::header names]}{  
  
        Check if header length is greater than 32768 bytes 
       if {[string length [HTTP::header value $header]] > 32768} {  
  
           Log header details 
          log local0. "Header exceeds 32768! Header Name: $header, Length: [string length [HTTP::header $header]],\ 
     Client: [IP::client_addr], User-Agent: [HTTP::header User-Agent], Value: [HTTP::header $header]"  
  
           Send a 400 response 
  HTTP::respond 400 content "Header value too longHeader value too long" 
  
           Close the TCP connection 
          TCP::close 
       }  
    }  
 } 
 

Keep in mind that that this rule checks every request header's length. It would add load to LTM. If you know that there are just a few headers you want to check, you can limit the checks to those:

 
 when HTTP_REQUEST { 
  
     Loop through each header name 
    foreach header {From If-Modified-Since Referer Content-Type}{  
  
        Check if header length is greater than 32768 bytes 
       if {[string length [HTTP::header value $header]] > 32768} {  
  
           Log header details 
          log local0. "Header exceeds 32768! Header Name: $header, Length: [string length [HTTP::header $header]],\ 
     Client: [IP::client_addr], User-Agent: [HTTP::header User-Agent], Value: [HTTP::header $header]"  
  
           Send a 400 response 
  HTTP::respond 400 content "Header value too longHeader value too long" 
  
           Close the TCP connection 
          TCP::close 
       }  
    }  
 } 
 

Aaron