Allowing only some paths - not working as planned

Hi all

I’m having some issues with an ACL that’s not working as intended. I have a service and I want to only allow very specific paths to be accessed. For example I want to allow access to but not However, I’m getting 403 forbidden even on /hello. Can someone help me with the syntax? For example, if I wanted to grant access to only these resources:

I created the below:

acl myhost_host hdr(host) -i

acl myhost_allowed_uri_paths path_beg,url_dec -i -m beg /hello | /images
acl myhost_allowed_uri_pages path_beg,url_dec -i -m beg /page
acl myhost_allowed_parm urlp(id) parameters | test | ok

http-request deny if myhost_host !myhost_allowed_uri_paths
http-request deny if myhost_host !myhost_allowed_uri_pages !myhost_allowed_parm

First of all you don’t separate multiple entries with a pipe. You just specify them.


/hello | /images


/hello /images


path_beg,url_dec -i -m beg

looks wrong.

Either you are url decoding the path and matching the beginning of it:

path,url_dec -i -m beg

Or just use path_beg directly:

path_beg -i /a /b /c

Second of all, there are logic flaws in your configuration, just redo it all with the opposite logic, it becomes way easier this way:

http-request allow if myhost_host myhost_allowed_uri_paths
http-request allow if myhost_host myhost_allowed_uri_pages myhost_allowed_parm
http-request deny

If you only want to deny on this particular host, replace the last line with:

http-request deny if myhost_host