Forum Discussion

Hugo_Frauches_2's avatar
Hugo_Frauches_2
Icon for Cirrus rankCirrus
Dec 11, 2018

ASM Transparent mode blocking CORS requests

Hello community,   I would like to know if anyone have seen or had an issue with CORS (Cross-Origin Resource Sharing) and ASM, i have an problem with Javascript request that its been blocked by CO...
application delivery
ASM Advanced WAF
security
  • Alex_Nimo_26616's avatar
    Alex_Nimo_26616
    Dec 16, 2018

    Hi Hugo,

     

    Thanks for the update. I agree, this is unacceptable. Never encountered something like this with ASM and I have dealt with CORS many times before. You can play with the CORS configuration through ASM or with an irule, I think that this is what I will do.

     

Alex_Nimo_26616's avatar
Alex_Nimo_26616
Icon for Altocumulus rankAltocumulus

Stumbled upon very similar issue yesterday. When ASM is configured( simple profile ) even in transparent mode, users on mobile chrome receive CORS error on certain iframes. When ASM is disabled, everything works flawlessly. Need to verify if ASM is striping down the CORS headers...

 

Hugo_Frauches_2's avatar
Hugo_Frauches_2
Icon for Cirrus rankCirrus
Dec 13, 2018

Hello Alex,

In fact the ASM does this, the F5 support told me this its by design on ASM:

"If you do not enable cross-domain request enforcement, the system removes all cross-origin request headers and CORS is not allowed for the URL."

For me this its unacceptable, F5 ASM shouldnt do this by default, because we have an feature called "transparent mode" and this CORS protection should be disabled and allowing * (Wildcards) by default. I have requested an RFE for this.