# Allowed HTTP Response code Blocked

**URL:** <https://community.f5.com/t/allowed-http-response-code-blocked/75123>\
**Category:** Technical Forums\
**Tags:** security\
**Created:** [September 11, 2024, 7:32am UTC](https://community.f5.com/t/allowed-http-response-code-blocked/75123 "2024-09-11T07:32:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ESFB](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@ESFB](https://community.f5.com/u/ESFB)\
**Post date:** [September 11, 2024, 7:32am UTC](https://community.f5.com/t/allowed-http-response-code-blocked/75123/1 "2024-09-11T07:32:23Z")

</div>

Dear All,

Need suggestion:- We have a ASM policy where response status code 403 is whitelisted. But while accessing the application F5 WAF is blocking the event/log with saying “Illegeal HTTP Status in Response” (403). Can i get suggestion on why this behavioral is observed.

Thanks in Advance.

---

<div class="post-metadata">

**Author:** ![Aswin\_mk](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/aswin_mk/32/5701_2.png) [@Aswin\_mk](https://community.f5.com/u/Aswin_mk)\
**Post date:** [September 11, 2024, 8:05am UTC](https://community.f5.com/t/allowed-http-response-code-blocked/75123/2 "2024-09-11T08:05:33Z")

</div>

Hello

Could you please verify attached link and allow the http response?

> **[myF5](https://my.f5.com/manage/s/article/K7922)**

---

<div class="post-metadata">

**Author:** ![ESFB](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@ESFB](https://community.f5.com/u/ESFB)\
**Post date:** [September 11, 2024, 8:23am UTC](https://community.f5.com/t/allowed-http-response-code-blocked/75123/3 "2024-09-11T08:23:10Z")

</div>

Hi Aswin,

We have allowed the response code 403 but still its being blocked by ASM.

---

<div class="post-metadata">

**Author:** ![Aswin\_mk](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/aswin_mk/32/5701_2.png) [@Aswin\_mk](https://community.f5.com/u/Aswin_mk)\
**Post date:** [September 11, 2024, 8:37am UTC](https://community.f5.com/t/allowed-http-response-code-blocked/75123/4 "2024-09-11T08:37:40Z")

</div>

By default F5 will not allow response code and if we allow this as per link it should allow . Can you check the logs and verify what error your getting. I hope you applied the policy after change and your waf is uptodate .

---

<div class="post-metadata">

**Author:** ![ESFB](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@ESFB](https://community.f5.com/u/ESFB)\
**Post date:** [September 11, 2024, 8:53am UTC](https://community.f5.com/t/allowed-http-response-code-blocked/75123/5 "2024-09-11T08:53:52Z")

</div>

Hi, yes we have already establishhed the whitelisting while creating the policy and all changes are applied to policy. This issue is persistant for one particular URL and not the entire VS the policy is mapped to.