CirrusHello experts,
https://my.f5.com/manage/s/article/K64208044
Can you tell me how to determine the traffic that is executing the URL, and whether it is relying on the "Referer"
header to judge?
If the site doesn't have "Referer"header does that mean you can't use this feature?
Any help is appreciate.
Thanks !!
MVPI admit I am not fully understanding your questions.
Yes , flow is based on Referrer headers and the entrypoint URL can be directly called as it it is start endpoint of the flow. This is like for example a main web page and after that the main page can have images that are located in other urls that will be accessed with web requests with referrer headers that show the main page.
You can enable the flow violations in learn and alarm and test the feature by accessing url that that shouldn't be accessed directly (not the flow entrypoint URL). This is how you can test without blocking traffic and seeing the request log 😉 Also read about flow parameters as well.
Also see:
Advanced WAF / BIG-IP ASM parameter matching (f5.com)