For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Aurel's avatar
Aurel
Icon for Cirrus rankCirrus
Mar 20, 2019

HTTP error response payload not delivered

Hello, An application is responding to his clients with an HTTP 422 error code and some small json data in body response. The ASM in front has been allowed to deliver the HTTP 422, but is not deliver...
ASM Advanced WAF
security
Aurel's avatar
Aurel
Icon for Cirrus rankCirrus
Jun 11, 2019

Thanks a lot for your comment.

I have no direct access to the F5 unfortunately, but as far as i can test on a working environnement, the backend server seems to simply not crafting any JSON at all.

On the client page, a small window is expected JSON data, but it is having instead a 422 HTTP message, that to my understanding, could not contain any response data.

The application team was suspecting the F5 device to remove or replace any data that was being responded to the client. I have checked already that no stream or any other manipulation action was in place. I should have more details soon.