Forum Discussion

SalC's avatar
SalC
Icon for Altostratus rankAltostratus
Apr 27, 2023

WAF / ASM : Referer: android-app://com.google.android.gm - Evasion Technique detected

Been seeing this Evasion Technique on the referer Header popping up in learning suggestions.  I'm hesitant to follow the learning suggestion to Set Evasion Techniques Violations to disabled on the referer.  The detected evasion technique is Multiple slashes,  This seems like something Android is doing that might be breaking the HTTP spec, or if not, should I pester F5 to not detect this?  Like I said, I'm hesitant to disable the Multiple slashes evasion technique outright,

Thanks for any feedback or insight!

security
  • Leslie_Hubertus's avatar
    Leslie_Hubertus
    Ret. Employee
    May 01, 2023

    Hi SalC - I'm featuring your post in today's Community Highlights to boost the chances someone in the community will come by with an answer for you. 

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Jul 09, 2023

    Seems to happen for more people and was sort of an attack at some time, but then mainly for trailing slashes, is that also in your case?

    I think what mainly matters is if that breaks funtionality on your website? Do you see traffic which feels legimate that triggers this alert? Because if not I would certainly not disable the alert. If it seems to be needed I would look into only disabling it in the cases needed.