Forum Discussion
NimbostratusLTM/ASM Prevent session hijacking using an iRule
CumulonimbusHi,
it was a strange behaviour, before trying to fix your behavior using an irule or other we will just be sure that asm policy was correctly configured:
When you apply session hijacking (Preventing) ASM stores the device ID along with other client data (including the message key or session ID) in a cookie that remains with the client for the length of the HTTP session. The system periodically checks that the device ID of the client is the same one that was assigned when the session started.
So In all Case ASM will blocked user request because the system periodically checks that the device ID of the client is the same one that was assigned when the session started...
You confirm that in ASM (Security ›› Application Security : Sessions and Logins : Session Tracking)
You apply:
- Detect Session Hijacking by Device ID Tracking
Note: When you are using device ID to track traffic, make sure that the Accept XFF setting is enabled in the HTTP profile that is assigned to the virtual server.
set the blocking modes for the hijacking violation, click Security > Application Security > Policy Building > Learning and Blocking Settings (select in ASM Cookie Hijacking violation Learn, Alarm, and Block. ).
For more info:
Keep me in touch
