F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

IT_Support_-_EC's avatar
IT_Support_-_EC
Icon for Nimbostratus rankNimbostratus
Jul 12, 2015

[BIG-IP 4000s] Failed to protect Crosse-Site Request Forgery

Dear F5 Team,   Our team did PoC of Cross-Site Request Forgery but it seemed that WAF cannot protect this attack. Our team said   "For the CSRF protection, F5 will generate its own Javascript t...
ASM Advanced WAF
security
boneyard's avatar
boneyard
Icon for MVP rankMVP
Jul 14, 2015

i would personally, certainly in a PoC, enable all three options in the blocking section for CSRF.

 

i checked in my lab, get the same situation with the comment on the script blocks but it works fine.

 

where exactly is the token expected where i doesn't show? remember there are cases where it isn't added specially in dynamically generated code.