For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

carolyndiep_163's avatar
carolyndiep_163
Icon for Nimbostratus rankNimbostratus
Dec 02, 2015

Difference between APM Cookie Options & ASM Cookie Properties

I noticed recently that in both APM and ASM, there is the ability to configure cookie options like Secure Flag and HTTP Only. Does anyone know the difference between how each module handles these coo...
ASM Advanced WAF
BIG-IP Access Policy Manager (APM)
security
Lucas_Thompson_'s avatar
Lucas_Thompson_
Historic F5 Account
Dec 02, 2015

The APM options are used to modify the APM cookies that are used for APM session management (MRHSession). The ASM options are used to modify other cookies traversing ASM.

 

I don't know if there is really a precedence issue here since the targets for the options are different. APM comes before ASM, so ASM settings shouldn't modify the APM cookies coming from the same BIG-IP.

 

Lucas_Thompson_'s avatar
Lucas_Thompson_
Historic F5 Account
Dec 02, 2015
ASM has cookies that itself to identify flows vs users, so there are settings for that. They're covered here: https://support.f5.com/kb/en-us/solutions/public/13000/700/sol13787.html Separately, ASM has security options to modify *other* application cookies, like from an HTTP service being protected by ASM. So, those cookies are not set by ASM itself. Rather, ASM is modifying 3rd party cookies.