IBM Security Access Manager for Web, Version 7.0

XSL transformation rules

A valid XSLT document can be used to transform the contents of the HTTP requests and responses.

The XSL transformation must output an XML document that defines the required changes. The output document contains a series of XML elements describing changes that must be made to the HTTP request or HTTP response.

Important: Author the XSLT documents carefully. Review and test the XSL transformation rules thoroughly before you implement it in a production environment. Incorrect syntax or badly formed XSLT might cause errors, or unexpected behavior.

The following table describes the base XML elements that WebSEAL requires in the transformed document:

Table 1. Base elements
Source document	Base XML element
HTTP Request	<HTTPRequestChange>
HTTP Response	<HTTPResponseChange>

The XSL transformation rules must handle the contents of the HTTP input. The content includes:

The ResponseLine/RequestLine element.
The Headers element.
The Cookies element.
The Body element. (HTTPResponseChange only)

If elements of the RequestLine/ResponseLine are included in the transformed XML document, WebSEAL applies the corresponding changes to the HTTP request/response.

Header elements require an action attribute in the XSLT document to determine how WebSEAL transforms the header. The available actions are:

add - adds a new header with a specific name and value.
update - updates the value of an existing header (if the header does not exist, it is added).
remove - removes the header with a specific name and value.

The Cookie elements require an action attribute in the XSLT document to determine how WebSEAL transforms the cookie. The available actions are:

add - adds a new cookie with the specified name and values.
update - updates the value of an existing cookie. (If the cookie does not exist, it is added).
remove - removes the cookie with a specific name.

Note: Cookies are represented differently in requests and responses. Only the response contains the attributes beyond name and value. When updating a cookie, specify the cookie name and the fields that you want to update. When adding a cookie, the minimum fields that you must specify are cookie name and value.

You can optionally include the Body element to insert a body into an HTTP response. The content of the Body must be URL encoded. WebSEAL decodes the content when it creates the response. WebSEAL replaces any existing body in the HTTP response with the new content that is provided in this Body element. This element does not require an action.

Note: It is not possible to replace the body content in requests.

Feedback