For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Laudec_107382's avatar
Laudec_107382
Icon for Nimbostratus rankNimbostratus
Feb 19, 2009

How not to cache SessionIDs

My client's WebX is caching all their session logons for SAP. From a security point of view this is not good. How do I tell WebX not to cache it at all? From HttpWatch I was able to find this, as the possible culprint:

 

 

http://fusion.company.local:8080/irj/portal/?MYSAP=701929596&PORTALSESSIONID=08AfilJdAs

 

 

It seems to cache that, and then doesnt ask for the username and password again after that.

 

application delivery
performance
wa

1 Reply

  • Dawn_Parzych_20's avatar
    Dawn_Parzych_20
    Feb 19, 2009
    Based on the information provided I'm not sure if the problem is that content is being cached on the browser or on the WebAccelerator. I think the problem is the former. Edit the policy and for the Pages node:

     

     

    Select Acceleration Rules from the drown down box

     

    Select Lifetime

     

    Under Client Cache Settings

     

    Select Insert No-Cache Directive into header

     

    Save

     

    Publish

     

     

    This may require that the WebAccelerators cache be cleared not just invalidated. Clearing the cache can only be done from the command line by issuing wa_clear_cache command. This will restart the accelerator process as the process restarts no traffic for a WebAccelerator enabled virtual will be processed so please make sure there is no production traffic running through the WebAccelerator when this command is issued.