For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

OOZOO_379158's avatar
OOZOO_379158
Icon for Nimbostratus rankNimbostratus
Dec 12, 2018

ASM TS challenge and caching

F5 ASM 13.1.0 is placed behind a CDN.   TSPD challanges injected in the web page is cached in the CDN, diable the cache option is not possible on the CDN, the assupmtion here is that the tspd toke...
ASM Advanced WAF
security
samstep's avatar
samstep
Icon for Cirrocumulus rankCirrocumulus
Jan 20, 2019

Only the static content (images/stylesheets/fonts/js/PDF files) should be placed behind CDN. The best practice is to put all static content onto a separate subdomain such a static.example.com or media.example.com

 

F5 ASM is a security device to protect the Dynamic contact (login pages, portals, applications,etc).

 

In case if the static contact is the part of the same application (e.g. /static subfolder) you can use the local traffic policy to disable ASM on that static content path. You can also disable the caching of dynamic pages by injecting 'Cache-Control: no-cache' HTTP header if the application you are trying to protect with F5 ASM is not doing it for some reason

 

Related Content