Bug ID 679751: Authorization header can cause a connection reset

Last Modified: Jul 23, 2021

Bug Tracker

Affected Product:  See more info
BIG-IP APM(all modules)

Known Affected Versions:
13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4, 13.1.1.5, 13.1.3, 13.1.3.1, 13.1.3.2, 13.1.3.3, 13.1.3.4, 14.0.0, 14.0.0.1, 14.0.0.2, 14.0.0.3, 14.0.0.4, 14.0.0.5, 14.0.1, 14.0.1.1, 14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 14.1.2.3, 14.1.2.4, 14.1.2.5, 14.1.2.6, 14.1.2.7, 15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2, 15.0.1.3, 15.0.1.4, 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 16.0.0, 16.0.0.1, 16.0.1, 16.0.1.1, 16.0.1.2

Fixed In:
16.1.0, 15.1.1, 14.1.2.8, 13.1.3.5

Opened: Aug 22, 2017
Severity: 4-Minor

Symptoms

APM resets connections and reports an ERR_ARG from a simple web request.

Impact

Connections are reset and APM logs ERR_ARG, which is not helpful for understanding the cause.

Conditions

-- APM profile with User Identification Method as HTTP. -- APM profile with User Identification Method as OauthToken. -- HTTP traffic arrives with certain types of Authorization headers.

Workaround

iRule workaround: when HTTP_REQUEST { if { [HTTP::header "Authorization"] contains "Bearer" && [string tolower [HTTP::header "User-Agent"]] contains "onenote" } { HTTP::header replace Authorization [string map {"Bearer" ""} [HTTP::header Authorization]] } }

Fix Information

APM no longer resets connections and reports an ERR_ARG from a simple web request.

Behavior Change