Hello,
It would be good to restrict the stream filter to only text content types. The flash content should be "application/something-flash". This avoids checking potentially large binary content that you don't want to perform the replacement for anyhow. If you disable the stream filter by default and add an if statement to enable it for text response types, it should solve the issue you're seeing and make the rule more efficient.
when HTTP_RESPONSE {
Disable the stream profile by default (so it's not left enabled for subsequent HTTP requests on the same TCP connection
STREAM::disable
Check if the response content type is text
if {[HTTP::header value Content-Type] starts_with "text"}{
STREAM::expression "@http://domain.@https://domain.@
STREAM::enable
}
}
Aaron