For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Philipp_Stadler's avatar
Philipp_Stadler
Icon for Nimbostratus rankNimbostratus
May 30, 2014

apm sso inline javascript

Hi all,   I'm trying to implement APM+SSO (form-based client-initiated) on a web-application. The form detection seems to work fine, because I can see injected Javascript in the page source on cli...
BIG-IP Access Policy Manager (APM)
security
Michael_Jenkins's avatar
Michael_Jenkins
Icon for Cirrostratus rankCirrostratus
Jun 27, 2014

I've just run into the same issue with APM+SSO and it's due to CSP (Content Security Policy). The application is sending a header that specifies where different things are allowed to be loaded from, like scripts, style sheets, fonts, and images). Newer, compliant browsers will interpret that header and depending on the settings, will disable inline javascript, which is how the APM adds if forms sso.

 

In order to fix this, you'll need to either modify the CSP directive for the application, or you can modify it through an iRule. See the following sites for more information on what CSP is and does. Unless the F5 engineers can update the APM SSO to use javascript files for the SSO stuff, this issue may become more prevalent over time with the standardization of HTML5 applications.

 

  • http://www.html5rocks.com/en/tutorials/security/content-security-policy/
  • http://www.cspplayground.com/home

Hope this helps.