For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mike_Maher's avatar
Mike_Maher
Icon for Nimbostratus rankNimbostratus
Feb 09, 2011

ASM removing cookies????

I wanted to see if anyone out there has ever encountered an instance where ASM would strip a cookie out of a request for whatever reason. We are having a problem with an application where users are being logged out randomly, and it appears we are seeing a missing session cookie in the web server logs. There is no proof pointing towards ASM as the culprit, but since it is a security device that blocks stuff, people tend to look in its direction. So I am just trying to get ahead of the game and see if anyone has seen this behavior? Any help is appreciated.

 

app sec
BIG-IP Access Policy Manager (APM)
security

1 Reply

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Feb 09, 2011
    Hi Mike,

     

     

    I don't remember every seeing ASM remove a cookie from a request or response. If it's reproducible, you could capture tcpdumps on LTM of the client and serverside connections to compare. I don't expect you'd see ASM causing this problem though as ASM typically doesn't modify content.

     

     

    Aaron