For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Dave_Burnett_20's avatar
Dave_Burnett_20
Icon for Nimbostratus rankNimbostratus
Nov 10, 2008

How to allow Search Engine Robots/Slurps through ASM?

We have recently installed a pair of F56400s (v9.4.3) in front of our website with ASM in blocking mode.     We are seeing and blocking loads of Non-RFC compliant request violations. Exami...
app sec
BIG-IP Access Policy Manager (APM)
security
dburnett_103851's avatar
dburnett_103851
Icon for Nimbostratus rankNimbostratus
Jan 28, 2009
Thanks for the posting.

 

 

As it now transpires that the 'Header Name with No Header Value' check actively protects against a HTTP Request Smuggling attack I've had no other choice but to re-enable the checks on our F5s.

 

 

However, this should now mean the Yahoo robots will start to be blocked again, so if there are other options to allow the slurps through, or to prevent HTTP Request Smuggling attacks whilst having the check turned off, I'd be glad to hear them