Forum Discussion

Dave_Burnett_20's avatar
Dave_Burnett_20
Icon for Nimbostratus rankNimbostratus
Nov 10, 2008

Modified Domain Cookie blocking

We have recently installed a pair of F56400s (v9.4.3) in front of our website with ASM in blocking mode.     Despite the fact that our Website only utilises a handful of cookies (all confi...
app sec
BIG-IP Access Policy Manager (APM)
security
hooleylist's avatar
hooleylist
Icon for Cirrostratus rankCirrostratus
Apr 29, 2009
A good proxy wouldn't leave its cookies in requests it sends out as it opens itself up to session hijacking. In 9.4.2+, you can ignore the cookies which start with BCSI using the modified domain cookies setting. The field accepts wildcards, so you can configure BCSI-*. Also, you could use an iRule to remove these cookies from requests. This would not affect the proxy functionality and it would be a secure option. Your web app should ignore these cookies. And it definitely should not set any BCSI- cookies in its response.

 

 

Aaron