For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

carolyndiep_163's avatar
carolyndiep_163
Icon for Nimbostratus rankNimbostratus
Dec 02, 2015

Difference between APM Cookie Options & ASM Cookie Properties

I noticed recently that in both APM and ASM, there is the ability to configure cookie options like Secure Flag and HTTP Only. Does anyone know the difference between how each module handles these coo...
ASM Advanced WAF
BIG-IP Access Policy Manager (APM)
security
Lucas_Thompson_'s avatar
Lucas_Thompson_
Historic F5 Account
Dec 02, 2015

The APM options are used to modify the APM cookies that are used for APM session management (MRHSession). The ASM options are used to modify other cookies traversing ASM.

 

I don't know if there is really a precedence issue here since the targets for the options are different. APM comes before ASM, so ASM settings shouldn't modify the APM cookies coming from the same BIG-IP.

 

carolyndiep_163's avatar
carolyndiep_163
Icon for Nimbostratus rankNimbostratus
Dec 03, 2015
The solution article you provided is to modify the ASM cookie and not the application cookie correct? The settings where ASM is modifying the cookie used by the web servers is located in the cookie properties in ASM under Security > Application Security > Headers > Cookie List > Edit Cookie, is that correct?