Forum Discussion

sandy16's avatar
sandy16
Icon for Altostratus rankAltostratus
May 05, 2015

CSRF protection if HTTP response is compressed

Hi, we plan to enable CSRF protection on the F5. As per the below solution, under the requirements it states that the response should NOT be compressed. - https://support.f5.com/kb/en-us/solutions/p...
ASM Advanced WAF
deployment
security
BinaryCanary_19's avatar
BinaryCanary_19
Historic F5 Account
May 06, 2015

It's server-side response.

The solution says that: ASM modifies the response in order to insert the CSRF javascript, and it only does it for responses that contain tag

html
, and which are uncompressed.