For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Rishi's avatar
Rishi
Icon for Altostratus rankAltostratus
Dec 07, 2021

Issues with cookies persistence

Need help on below issues:   Seeing "Sensitive Cookie with Improper or Insecure or Missing SameSite Attribute" message, when user is generating report from F5 url.   Currently: Default cookie...
application delivery
BIG-IP
LTM
Dario_Garrido's avatar
Dario_Garrido
Icon for Noctilucent rankNoctilucent
Apr 01, 2022

Hello Rishi.

Take into account that cookie persistence by default inserts a new cookie in the HTTP request.

If your app has specific restrictions to protect against CSRF, that would raise some of those messages.

Check the SameSite condition.
https://cwe.mitre.org/data/definitions/1275.html

Maybe, in your case, a "SameSite=Lax" condition is needed