Hi, we are running 11.5.1 ...

with 11.2.0, if the clients sends a requests with a TS cookie without value, you get an 'ASM modified', which is ok. with 11.5.1, if the clients sends a requests with a TS cookie without value, you get an 'Cookie not RFC-Compliant', which is bad. Can someone confirm that as bug or is it a changed feature? Didn't found something in the release notes. thx

Nice, I have to splitt my question to get it online.

Someone else with this behaviour?

This is expected behaviour. See here for how to overcome this behaviour: ">https://support.f5.com/kb/en-us/solutions/public/7000/700/sol7776.html" target="_blank">">https://support.f5.com/kb/en-us/solutions/public/7000/700/sol7776.html

The spam filter really sucks. Thx for the solution.

ASM cookie without value not RFC-compliant

10 Replies

Torti
Cirrus
Nov 13, 2014
with 11.2.0, if the clients sends a requests with a TS cookie without value, you get an 'ASM modified', which is ok. with 11.5.1, if the clients sends a requests with a TS cookie without value, you get an 'Cookie not RFC-Compliant', which is bad. Can someone confirm that as bug or is it a changed feature? Didn't found something in the release notes. thx
Torti
Cirrus
Nov 13, 2014
Nice, I have to splitt my question to get it online.
Torti
Cirrus
Nov 18, 2014
Someone else with this behaviour?
What_Lies_Bene1
Cirrostratus
Nov 18, 2014
This is expected behaviour. See here for how to overcome this behaviour: ">https://support.f5.com/kb/en-us/solutions/public/7000/700/sol7776.html" target="_blank">">https://support.f5.com/kb/en-us/solutions/public/7000/700/sol7776.html
Torti
Cirrus
Nov 20, 2014
The spam filter really sucks.

Thx for the solution.
- Torti
  Cirrus
  Nov 20, 2014
  I found it, too but: 1. It is not for 11.x
- Torti
  Cirrus
  Nov 20, 2014
  2. my combination (ASM header with '=' and no value) isn't described 3. If I set any other coookie without value (cookiename=), I don't get the error message. 4. there was another behaviour in 11.2. 5. Sol7011 describes the behaviour as I can see in 11.2
GrantS
Nimbostratus
Dec 23, 2014
I'm seeing the same issue after upgrading from 11.3.0 to 11.5.1. Before upgrading, one of my ASM profiles generated an abnormally large number of 'ASM modified' violations. After the upgrade, the same profile generates an abnormally large number of 'Cookie not RFC-complaint' violations instead of the 'ASM modified' violations. Viewing the violation details lists the cookies that have been flagged are all TS cookies which have not value (TSxxxxxxxx=;) Does anyone know what the root cause for this behavior?
Vesna_King_1375
Nimbostratus
Sep 28, 2015
We have upgraded from 11.2 to 11.6 and now instead of "ASM modified" we are seeing "Cookie not RFC-Compliant". The problem is that the client's browser sends empty cookies which are RFC compliant. This seems to be happening only for Chrome users (mostly on Mac OS X10 and Windows 7). ASM detects issue only for its own cookies (TSxxxxxx=;) and this behaviour does not seem to be in line with article 7776. The impact to the user is that he will not be able to connect to the website until the cookies are completely cleared. The possible workaround is to downgrade "Cookie not RFC-compliant" violation, but this would allow various genuine attacks against cookies to get passed the firewall. Does anyone know why was there a change in the ASM behaviour?
Ghislain_Pellet
Nimbostratus
Feb 07, 2018
I'm experiencing the same blocking behaviour but the security policy has the Cookie not RFC-compliant unchecked. How can I prevent the ASM version 11.6.2 from blocking its own main ASM cookie (TSxxxxxx=;) while this violation is not even configured as blocking?