For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

tuganim's avatar
tuganim
Icon for Altostratus rankAltostratus
Oct 21, 2020
Solved

GUID omission in request URL

Hello, I use BIG-IP 14.1.2.7 with the ASM module. I have a URL in my system which includes a dynamic GUID as part of the URL. For example: “/api/user/9fa42455-7adc-4550-813d-53c1aed654a9/permissions...
ASM Advanced WAF
BIG-IP
security
  • boneyard's avatar
    boneyard
    Oct 22, 2020

    can it be the "Dynamic Session ID in URL" setting on the advanced security policy settings which is different between the policies?

     

    https://support.f5.com/csp/article/K6756

boneyard's avatar
boneyard
Icon for MVP rankMVP
Oct 22, 2020

can it be the "Dynamic Session ID in URL" setting on the advanced security policy settings which is different between the policies?

 

https://support.f5.com/csp/article/K6756

tuganim's avatar
tuganim
Icon for Altostratus rankAltostratus
Oct 22, 2020

This setting is indeed different between the two policies and it seems that this is the cause of the issue. in the first instance - the one in which I had the problem - this setting is enabled and its value is a regular expression that matches a GUID. In the second instance this setting is disabled.

 

Thank you very much!