For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Rodolphe_AUBINE's avatar
Rodolphe_AUBINE
Icon for Nimbostratus rankNimbostratus
Jun 28, 2010

Cookie not RFC-compliant with Asp.net flows

Hi,     I have some strange blocked requests because of "Cookie not RFC-compliant".     Examples :   Invalid carriage return, Invalid equal sign preceding cookie name, Invalid space i...
app sec
BIG-IP Access Policy Manager (APM)
security
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Jun 28, 2010
Hi Rodolphe,

 

 

There is a bug with cookie parsing in ASM in several versions:

 

 

SOL10764: Large POST requests may trigger BIG-IP ASM cookie violations

 

https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10764.html

 

 

However, it looks like snippet you've posted is being parsed incorrectly by ASM. This "prod/callpayment0xd0xaCookie:0x20JSESSI" looks like a prior header value, a carriage return and line feed and then the start of the cookie header.

 

 

Can you post an anoymized copy of the full request?

 

 

Thanks, Aaron