For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mike_Maher's avatar
Mike_Maher
Icon for Nimbostratus rankNimbostratus
Oct 07, 2009

Multiple Decodings

I have an application that is showing a lot of violations for Multiple Decoding. From I am seeing it looks like I can increase the value to 2 to 3, and that should help my problem but not necessarily...
app sec
BIG-IP Access Policy Manager (APM)
security
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Oct 07, 2009
Is the value triggering the violation encoded more than two times? I've seen one or two bugs with this functionality in 9.4.x.

 

 

In general, I think ASM decodes the exact number of times configured. If there are still percent encoded values a violation is triggered. I don't think there is any significant performance hit if you set it for 3 decodings and the clients only send double encoded values. I'd expect ASM wouldn't decode the parameters if there wasn't anything to decode.

 

 

In our customer's policies, I always try to enable this check.

 

 

Aaron