For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Dan_Markhasin_1's avatar
Dan_Markhasin_1
Icon for Nimbostratus rankNimbostratus
Oct 25, 2015

Blocking POST with ASM?

Hi,   I am wondering if there is anyway to disallow the usage of POST using an ASM policy? It seems to be allowed by default with no way to uncheck?   Thanks, Dan  
ASM Advanced WAF
security
samstep's avatar
samstep
Icon for Cirrocumulus rankCirrocumulus
Dec 02, 2015

If you need to disable POST globally (e.g. you have a virtual server only serving static content) then one way of doing this is via an iRule.

when HTTP_REQUEST {
    if {[HTTP::method] eq "POST"} {
      reject
    }
}

In ASM policy you can stop POST going through by setting the POST data length to 0 on the File Type and enabling blocking on "Illegal POST data length" violation.

Hope this helps,

Sam