For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jeroen_Steenkam's avatar
Jeroen_Steenkam
Icon for Nimbostratus rankNimbostratus
Feb 06, 2019

v13.1 How to overrule an ASM_RESPONSE_VIOLATION of attack type ATTACK_TYPE_INFORMATION_LEAKAGE

The ASM module first scans the request for violations. Without violations the request is then forwarded to the webserver. Next, the ASM module scans the response for violations. Currently, HTTP Respo...
ASM Advanced WAF
devops
iRules
samstep's avatar
samstep
Icon for Cirrocumulus rankCirrocumulus
Feb 11, 2019

Allowing HTTP Response Code 500 to be returned to the client is a really bad design as it gives the potential attackers information on how to crash your application.

 

If you need to allow code 500 response for certain URLs then you can use ASM::disable in iRule