Forum Discussion

OOZOO_379158's avatar
OOZOO_379158
Icon for Nimbostratus rankNimbostratus
Dec 12, 2018

ASM TS challenge and caching

F5 ASM 13.1.0 is placed behind a CDN.

 

TSPD challanges injected in the web page is cached in the CDN, diable the cache option is not possible on the CDN, the assupmtion here is that the tspd token is placed in all the pages.

 

advanced bot protection is not used because of this.

 

The troubleshooting is showing number all users get the same token "cached by the CDN" thats, rendering any user fail the check!

 

ASM Advanced WAF
security
  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Jan 20, 2019

    Only the static content (images/stylesheets/fonts/js/PDF files) should be placed behind CDN. The best practice is to put all static content onto a separate subdomain such a static.example.com or media.example.com

     

    F5 ASM is a security device to protect the Dynamic contact (login pages, portals, applications,etc).

     

    In case if the static contact is the part of the same application (e.g. /static subfolder) you can use the local traffic policy to disable ASM on that static content path. You can also disable the caching of dynamic pages by injecting 'Cache-Control: no-cache' HTTP header if the application you are trying to protect with F5 ASM is not doing it for some reason