For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Dan_Bowman's avatar
Dan_Bowman
Icon for Cirrus rankCirrus
Oct 12, 2017

ASM Brute Force when app success/fail isn't the first response?

Hi guys,   I've been looking at configuring ASM Brute Force protection for a couple of web apps. The challenge I'm hitting is that the app doesn't instantly respond with a success/fail criterion ...
ASM Advanced WAF
brute force
security
samstep's avatar
samstep
Icon for Cirrocumulus rankCirrocumulus
Oct 16, 2017

No form parameters is a potential problem - you need at least username for brute force detection to work as ASM needs to associate the session with a user in order to count the number of failed login attempts for that username from the same IP address or within the same HTTP Session.

 

You might need a bespoke iRule if you can't have a reliable way to associate a username with a failed login response.