Forum Discussion

smp_86112's avatar
smp_86112
Icon for Cirrostratus rankCirrostratus
Jan 16, 2009

POST data length error

As I was reading the definition of "POST data length error" in the ASM config guide, I started thinking about how ASM actually calculates the length of POST data. I was hoping someone could elaborate.

 

 

What I'm wondering to myself is if ASM has to buffer the entire HTTP POST before calculating how large it is? And if that's the case, I wonder what effect that might have on HTTP applications where large client uploads are normal, or from a TCP perspective? I can't imagine ASM blindly compares the Content-Length header against the security policy.

 

 

Would appreciate any thoughts. Thanks.
app sec
BIG-IP Access Policy Manager (APM)
security
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jan 19, 2009
    Maybe Ido or someone else with more technical info on ASM could answer. But in the meantime, I think ASM does buffer the entire payload in order to validate the data.

     

     

    You could test your second question by using an interception proxy to modify the Content-Length header value on a POST request. I also assume it doesn't use the header value to validate the payload length.

     

     

    Aaron