For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

strongarm_46960's avatar
strongarm_46960
Icon for Nimbostratus rankNimbostratus
Dec 01, 2008

To many Cookies

I have just recenty put ASM in front of a large app, this app has been known to set up to 17 or more cookes per session depending on what transaction the user is doing, problem is ASM seems to set a f...
app sec
BIG-IP Access Policy Manager (APM)
security
AaronJB's avatar
AaronJB
Ret. Employee
Dec 15, 2008
It looks like those are Path Cookies.

 

 

Starting in v9.4.2 we sign Domain Cookies on a per-path basis. Domain Cookies belonging to the root path are signed in the main ASM cookie (TSxxxxxx, where the x's are generated from the HTTPClass name), and those belonging to sub paths are signed in additional ASM cookies with one cookie being added for each distinct paths.

 

 

Having said that, there seem to be three distinct ASM cookies in the above example, and I only see two paths.. there's only three if you count the trailing "/" which is on some cookies and not others, and I'm not sure if that 'should' be considered relevant in terms of distinct paths.

 

 

Aaron