Forum Discussion
Chris_Hotchkiss
Nimbostratus
NimbostratusiRule to mitigate CSRF
Some of our application developers are asking about an iRule that could possibly insert a nonce onto a page during a session that would help prevent a cross-site request forgery from happening. Unfor...
hooleylist
Cirrostratus
CirrostratusHi Chris,
There is built in functionality to do this in the Application Security Manager (ASM). I guess it's technically possible to do in an iRule--but it would be complicated to try to parse each parameter from the response HTML and inject the nonce.
Aaron