For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

tomh_185559's avatar
tomh_185559
Icon for Nimbostratus rankNimbostratus
Jun 10, 2015

Cookie RFC compliant? Unusual use case

I'm investigating some interesting security events when implementing ASM rules against a VIP. The ASM logs list an event that the request contains "Cookie not RFC-compliant" due to "Invalid character...
ASM Advanced WAF
security
boneyard's avatar
boneyard
Icon for MVP rankMVP
Jun 13, 2015

i don't believe there is a way to allow things like this in another way then disable the violation. f5 decided on what they consider RFC compliant and you can't tweak that.

 

you could consider building an irule which uses another ASM policy with this violation disabled only when this type of cookies is used.