Forum Discussion
Aantat
Cirrus
CirrusFacing problem with Modified domain cookies
Hello.
I'm facing problem with Modified domain cookies. I have configured ASM policy in blocking mode with some enforced cookies. Also I have enabled blocking on Modified domain cookies on Learning and Blocking settings. So the problem is some users get blocked with Modified domain cookies, but they can access to app via Incognito mode of browser. Seems like the reason of this is because they're using old cookies (?) Is this correct behaviour of ASM? Is it because of expired cookies? What should I do? Any suggestions?
Hi Aantat ,
Are there any device in your path makes any kind of Cookie persistence or not ?
I want to say if there are " any persistence Cookies " in Requests that pass via F5 ASM , it will make such these violations and in this case this is a false positve you should dis-check mark from "block" box in learning and blocking setting for the impacted service.
> another solution , take a har file or extract the payload itself from F5 Event logs and see which cookies are sent in requests , After That contact with server developer to discuss with him these cookies and expiration periods or validate if these cookies accept modification or not , the only one who should decide if these cookies accept modification or not is server developer/owner for better visability in your applications.
Note : you should find server cookies in http header called " set-cookie" header.
- To get the har Archive file , Follow this KB :
https://support.f5.com/csp/article/K10370211
- For more info about Modified domain cookies violations and its possibility to be false positive , read the following articls :https://support.f5.com/csp/article/K89255958
https://support.f5.com/csp/article/K5907
I hope my reply helps you
AantatHi, i dismarked block setting and find the reason of problem. So violation is triggered when user uses my app via example.com after www.example.com. Is there any suggestion on that? Should I do redirect from www to my example.com?
Hi Aantat ,
Can you clarify more ,
What is your APP , and www.examble.com / example.com.
Do you want to redirect all requests to example.come instead of www.example.com ,
I need some clarification.
- G-Rob
Employee
BIG-IP ASM cookies are session based and do not get written to disk. When the user is connecting to the application using incognito mode, there is no existing cookie so the violation is not triggered. See K5907: BIG-IP ASM violation: Modified domain cookie
The most common reason the cookie changes is that the client makes a request to another app on the same domain not passing through the same ASM policy which modifies the cookie. Another common cause for the violation is that the ASM cookie is set with a different expiry than the app's cookie. If you can reproduce the issue, try using your browser's development tools to view the cookies in use for the application and monitor changes to the cookie between ASM sessions.
- Aantat
Hi, so I think I find the reason of my problem. Violation is triggered when user uses my app via example.com after www.example.com. Is there any suggestion on that? Should I do redirect from www to my example.com?
