Forum Discussion
IT_Support_-_EC
Nimbostratus
Nimbostratus[BIG-IP 4000s] Failed to protect Crosse-Site Request Forgery
Dear F5 Team,
Our team did PoC of Cross-Site Request Forgery but it seemed
that WAF cannot protect this attack. Our team said
"For the CSRF protection, F5 will generate its own Javascript t...
boneyard
MVP
MVPi would advise you to read up on Cross Site Request Forgery and the mitigation of it.
https://en.wikipedia.org/wiki/Cross-site_request_forgery https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29 https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet
in the end it comes down to the fact you don't have to protect a request that doesn't carry data.
