For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Dan_Markhasin_1's avatar
Dan_Markhasin_1
Icon for Nimbostratus rankNimbostratus
Oct 25, 2015

Blocking POST with ASM?

Hi,

 

I am wondering if there is anyway to disallow the usage of POST using an ASM policy? It seems to be allowed by default with no way to uncheck?

 

Thanks, Dan

 

ASM Advanced WAF
security

2 Replies

  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Dec 02, 2015

    If you need to disable POST globally (e.g. you have a virtual server only serving static content) then one way of doing this is via an iRule.

    when HTTP_REQUEST {
    if {[HTTP::method] eq "POST"} {
      reject
    }
}

    In ASM policy you can stop POST going through by setting the POST data length to 0 on the File Type and enabling blocking on "Illegal POST data length" violation.

    Hope this helps,

    Sam