For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

smalex's avatar
smalex
Icon for Altostratus rankAltostratus
Jun 13, 2019

CSRF Protection makes application inaccessible from Chrome

We have enabled ASM recently. If I enable CSRF Protection, the site becomes inaccessible from chrome but works fine from IE. When disabled, site loads perfectly fine. I could not find any logs under ...
application delivery
ASM Advanced WAF
BIG-IP
security
Jiri_Rosenmayer's avatar
Jiri_Rosenmayer
Icon for Altostratus rankAltostratus
Jun 13, 2019

Hi,

 

see this article

https://support.f5.com/csp/article/K11930

 

When you enable the CSRF protection feature, the system inserts custom JavaScript into the response pages of protected web applications.

In my experience this is often a problem and I try to avoid using any ASM feature which inserts JS

 

In your case probably, when the ASM inserts the JS, the IE can still render the page but chrome cannot. Check where in the response the ASM inserts the JS. You can solve this either by turning off the CSRF or update your application so that the ASM inserts to JS to "better" location in the HTTP response. So that even chrome can render the page.

 

Hope it helps

 

Jiri