For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Aaron_Longnecke's avatar
Aaron_Longnecke
Icon for Nimbostratus rankNimbostratus
Nov 22, 2011

Parameter interfering with web site pop-up

I have a web application running on a box behind a BIG-IP system running both LTM and ASM. before we turned on the ASM features, we could access the pop-ups that it would create from a link in the browser. When we turned on the ASM, it started adding a parameter to the URL, which causes the pop-ups to resolve incorrectly. The URL ends up trying to open up /source?CSRT=********?session=true. Is there any way to get rid of the bold portion so that this can resolve correctly?

 

app sec
BIG-IP Access Policy Manager (APM)
security

2 Replies

  • Ido_Breger_3805's avatar
    Ido_Breger_3805
    Historic F5 Account
    Nov 23, 2011
    Hi Aaron,

     

    What you see is the paramater that ASM adds in order to protect against CSRF.

     

    You can either disable that protection for the popup URL, or, upgrade to V11 where this issue is fixed (ASM will clean that paramater before it forward the request to the web server)

     

    Cheers,

     

    Ido