For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Olowndez's avatar
Olowndez
Icon for Nimbostratus rankNimbostratus
Jan 30, 2020

Encrypt the name or rename the AVR cookies

Hello folks:

 

I have some virtual servers which have the analytics profile enabled, so I am able to collect statistics of the traffic passing through such vs. However, after performing an Ethical Hacking procedure in my infrastructure, I was requested to rename the cookies that AVR uses such us: f5_cspm=; f5avrbbbbbbbbbbbbbbbb=; f5avrbbbbbbbbbbbbbbbb or encrypt their names. Such names are visible to attackers so I need them to be changed to some less F5-descriptive ones. Here https://devcentral.f5.com/s/question/0D51T00006i7k1N/how-to-rename-cspm-cookie-name there is only the process to rename the f5_cspm cookie. F5 says that the other cookies that start with f5avr cannot be renamed. How could achieve this requirement?

 

Thanks

 

application delivery
LTM

2 Replies

  • Andrew-F5's avatar
    Andrew-F5
    Icon for Employee rankEmployee
    Jan 31, 2020

    https://support.f5.com/csp/article/K14815

    ◘ You cannot modify a cookie name that is set by the AVR module.

    ◘ Beginning in BIG-IP 11.4.0, the cookie is also encrypted and should be considered safe by security scanning devices.

  • Zev's avatar
    Zev
    Icon for Altostratus rankAltostratus
    Dec 03, 2020

    You can most definitely use similar logic as the article points out:

     

    modify sys db avr.cookieprefix value "my new avr prefix"

     

    It is not controlled by the AVR module.