For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

KF2's avatar
KF2
Icon for Nimbostratus rankNimbostratus
Oct 26, 2022

Modified domain cookie

Receive some blocked event about "modified domain cookie". After some research , a cookie "TSxxxxxxxx" is generated by F5 ASM and it used to hash the enforce cookie. When user got blocked, I found ...
security
KF2's avatar
KF2
Icon for Nimbostratus rankNimbostratus
Oct 26, 2022

The user is not internal. 

"This is a tricky one as maybe the user is comming from a jump host or there is a proxy device before the F5 that does something" <--  You mean the proxy device will modify or delete the cookie?

All the links you posts i have already read before I post this question in this forum.

Nikoolayy1's avatar
Nikoolayy1
Icon for MVP rankMVP
Oct 26, 2022

I admit that are all my suggestions as if the F5 is sending the cookie what happens on the client device, I can't tell 🙂

 

My final suggestion could be to also use One Connect profile as it helps with cookies and upstream proxy devices but outside of that I am out of ideas.

 

https://support.f5.com/csp/article/K7964