For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Rishi's avatar
Rishi
Icon for Altostratus rankAltostratus
Dec 07, 2021

Issues with cookies persistence

Need help on below issues:

 

Seeing "Sensitive Cookie with Improper or Insecure or Missing SameSite Attribute" message, when user is generating report from F5 url.

 

Currently: Default cookies persistence is applied on URL.

 

Thanks

 

 

application delivery
BIG-IP
LTM

1 Reply

  • Dario_Garrido's avatar
    Dario_Garrido
    Icon for Noctilucent rankNoctilucent
    Apr 01, 2022

    Hello Rishi.

    Take into account that cookie persistence by default inserts a new cookie in the HTTP request.

    If your app has specific restrictions to protect against CSRF, that would raise some of those messages.

    Check the SameSite condition.
    https://cwe.mitre.org/data/definitions/1275.html

    Maybe, in your case, a "SameSite=Lax" condition is needed