For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Nifford's avatar
Nifford
Icon for Nimbostratus rankNimbostratus
Sep 17, 2015

APM Access Profile inserting characters into page source?!

I am working on configuring SSO into as many applications as possible. We have an access profile setup that requires forms based authentication from a user, and then uses NTLM to SSO into apps. I recently ran into a bizarre issue with one of our applications. As soon as I configure an Access Profile for one of our LTM virtual servers, it changes the page source for every page, inserting 4 characters at the top of the page:

 

It also inserts a 0 at the bottom of the page:

 

If I remove the access profile, so it is just an LTM virtual server (SSL Offload, HTTP iApp Configuration), it seems to work just fine:

 

We're not doing anything with connectivity profiles, rewriting, or patching in APM. Has anyone seen this before, or know what causes it? Even if you're not entirely sure how to fix it, any input to point me in some direction would be helpful.

 

For reference, we're running Big-IP 11.5.1 HF8.

 

Thanks for reading.

 

BIG-IP Access Policy Manager (APM)
security

5 Replies

  • Seth_Cooper's avatar
    Seth_Cooper
    Icon for Employee rankEmployee
    Sep 17, 2015

    Hi!

    You are running into a known issue. It is tracked as BugID 383341. Basically when using SSO the content is not unchunked correctly. This can be fixed in an iRule or, even better, with a new http profile:

    ltm profile http http-rechunk {
    app-service none
    defaults-from http
    response-chunking rechunk
}

    Please create a new http profile and apply it to the virtual server and see if the behavior improves.

    If this fixes your issue please let us know and also please open a support case to have your company attached to the BugID.

    Regards,

    Seth

  • Nifford's avatar
    Nifford
    Icon for Nimbostratus rankNimbostratus
    Sep 18, 2015

    I changed the response-chunking setting on the http profile, and that resolved it. Thank you for your response. I will open a case to have our company attached to the BugID.

     

  • Requinbleu's avatar
    Requinbleu
    Icon for Nimbostratus rankNimbostratus
    Mar 13, 2019

    Hi I just hit this bug on version 12.1.2. I don't find any information on bug 383341 in bug tracker. I doing the patch giving by Seth Cooper and now it work.