Forum Discussion
sandy16
Altostratus
AltostratusCSRF protection if HTTP response is compressed
Hi, we plan to enable CSRF protection on the F5. As per the below solution, under the requirements it states that the response should NOT be compressed. - https://support.f5.com/kb/en-us/solutions/public/11000/900/sol11930.html
Is this referencing the response from the server or from the F5?
thnx
1 Reply
It's server-side response.
The solution says that: ASM modifies the response in order to insert the CSRF javascript, and it only does it for responses that contain tag
, and which are uncompressed.html
