Forum Discussion

jayson27's avatar
jayson27
Icon for Cirrus rankCirrus
Oct 11, 2024

Blocking client that uses existing cookie

Hi, We are trying to block a client that uses existing cookie. We try to configure session hijacking protection but they are still able to connect. May I know another method to block the client tha...
application delivery
asm
security
waf
Paulius's avatar
Paulius
Icon for MVP rankMVP

What makes you believe they're using an existing cookie rather than receiving a new one?

jayson27's avatar
jayson27
Icon for Cirrus rankCirrus
Oct 14, 2024

Hi,

We are running this to a UAT, and they are trying to access first the legitimate user once successfully login they copied the cookies of the legit user then it will be imported to another user browser. 

  • zamroni777's avatar
    zamroni777
    Icon for Nacreous rankNacreous
    Oct 14, 2024

    in my opinion, it's not valid test case for waf or reverse proxy such as f5 asm/ltm
    because browsers also reuse non expired cookies in legitimate access.

    i suggest the application should add captcha to verify human users.

    if you have enough apm user session license, you can also put the app access via apm webtop portal.
    my customer use this mechanism for corporate internet banking access.

  • Paulius's avatar
    Paulius
    Icon for MVP rankMVP
    Oct 17, 2024

    To be clear, this is what you did already?

    https://techdocs.f5.com/en-us/bigip-14-1-0/big-ip-asm-implementations-14-1-0/preventing-session-hijacking-and-tracking-user-sessions.html