For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Abouja's avatar
Abouja
Icon for Nimbostratus rankNimbostratus
Sep 24, 2022

AWAF Brute Force protection not working for HTML Web application

Hi Team, I have configured login page and Brute force protection for my web application but it is not working: The content-type of the request is Content-Type: application/x-www-form-urlencoded be...
security
Mohamed_Salah_'s avatar
Mohamed_Salah_
Icon for MVP rankMVP
Sep 25, 2022

Hello Ahmed,

Please make sure that the brute force settings in the learning and blocking settings is enabled, (blocked).

and modify the brute force profile and select the login page created in the ASM policy inside the brute force protection. if you have finished these steps, you can start changing the login condition:

  • for example try expected status code "302" as the response was 302.
  • or unexpected status code, for example "200"
  • Or unexpected string in the response and check for a string that shows when you login with wrong credntials, for example "login failed".

All of these results (expected and unexpected) can be found in the developer tool inside the response and headers tab.