Forum Discussion

boneyard's avatar
boneyard
Icon for MVP rankMVP
Jun 07, 2012

ASM violation: Modified domain cookie(s)

im getting this violation, from the info provided by the ASM it seems to happen when the cookie is first set, am i correct on that? it feels like this is a quite common thing to happen, is it some you...
app sec
BIG-IP Access Policy Manager (APM)
security
BT_90520's avatar
BT_90520
Icon for Nimbostratus rankNimbostratus
Jun 07, 2012
Modified domain cookie is the minimal violation that we should really catch - that is actually tampering the actual web application cookie like your jsession, php_session etc. There are more to track (see below link) but personally, that is mandatory since it is user appl and specifically configured to track the trusted session. The moment session cookie is tampered, quite a few abuse cases can happened like session replay, hijack etc. Even XSS like to reveal session cookie

 

 

http://support.f5.com/kb/en-us/solutions/public/6000/800/sol6850.html