For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

amolari_4313's avatar
amolari_4313
Icon for Nimbostratus rankNimbostratus
Mar 12, 2014

APM cookies

Is the format (values) of the F5_ST cookie explained somewhere? I have idle-timeout configured in an AP for WebApplication and I see that cookie set+modified but I do not get the logic. Also, I see that the after APM logon the browser is getting /vdesk/timeoutagent-i.php which sets a cookie named "TIN". Any information on that? AskF5 is mute about it. Thx

 

BIG-IP Access Policy Manager (APM)
design
security

2 Replies

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Mar 12, 2014

    The F5_ST cookie is used to keep the client side JavaScript (injected by APM) informed about session and inactivity timeouts.

     

    I've seen the TIN cookie, but not certain what it's for.

     

  • amolari's avatar
    amolari
    Icon for Cirrostratus rankCirrostratus
    Mar 12, 2014

    In the same session I see the cookie value set first from server (APM) to value "1z1z1z1394623994z86400". Then the cookie is later sent from the client (without being set by the server with value "1394624119c3600c100c1394624119c86400c600c" How I should read those values? some part are unix timestamps and some are the AP timeout values (3600 / 86400 in this case)