F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

ee's avatar
ee
Icon for Cirrus rankCirrus
Oct 01, 2024

Why does WAF block HTTP OPTION method

Does the HTTP Option method pose significant security risk to the web application? 
HttpMethod
options
Aswin_mk's avatar
Aswin_mk
Icon for MVP rankMVP
Oct 01, 2024

Hi ee 

 

i have read in so many articles relating the threats by option method, main thing is attackers mostly using it. if an application doesn't need the method, no need of using it. so as per awaf by default below mentioned only allow if it's a blocking profile.

 

 

 

BR

Aswin

ee's avatar
ee
Icon for Cirrus rankCirrus
Oct 02, 2024

Hi, May I know what is meant by the "Methods: act as GET" from the screenshot provided?