For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Steve_Brown_882's avatar
Steve_Brown_882
Historic F5 Account
Nov 06, 2008

Masking jsessionid with ASM

I am looking for some input on how we can resolve an issue we have with a weblogic based application which is behind an F5 with ASM. The problem is that we would like to mask the jsesionid from the ur...
app sec
BIG-IP Access Policy Manager (APM)
security
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Nov 11, 2008
If you (or your dev team) is willing to block clients who don't support cookies, couldn't you avoid the possible session ID leakage issue by not using the jsessionid in the URI?

 

 

I'd still suggest that using SSL for all but the initial request would provide better security and definitely better functionality for all clients--including those that don't support cookies.

 

 

That doesn't answer your question about enforcing the dynamic session ID in the URI. Does anyone know if you need to configure the dynamic session ID in URI regex as well as the extraction in order to validate the session ID?

 

 

Aaron