Forum Discussion
IT_Support_-_EC
Nimbostratus
Nimbostratus[BIG-IP 4000s] Failed to protect Crosse-Site Request Forgery
Dear F5 Team,
Our team did PoC of Cross-Site Request Forgery but it seemed
that WAF cannot protect this attack. Our team said
"For the CSRF protection, F5 will generate its own Javascript t...
boneyard
MVP
MVPsure a HTTP GET / POST without parameters does indeed carry some data, but in general not enough on itself to perform transactions. that is normally done with parameters and that is what CSRF protection is designed for.
if you design your application as described above you have a situation (although not very common in my opinion) where the F5 CRSF protection doesn't protect you.
that is a limitation of the product. if you want a full proof solution specific for your situation you gotta build it yourself at lots of effort. a solution like F5 ASM will protect you with less effort but upto a point, it can't cover every possible situation.
