cancel
Showing results for 
Search instead for 
Did you mean: 

crsf Incorrect interception

小白
Cirrus
Cirrus

After I have configured crsf protection and my attack is intercepted, why will my normal operation be intercepted, and the normal access of other devices under the same LAN is also intercepted. I think this is a problem. In addition, I want to ask whether ASM has a list of blocked IP (not a manually configured blacklist)

9 REPLIES 9

SamCo
Cirrus
Cirrus

Hello,

With the limited information we have on your configuration, it's hard to help you.

Anyhow, an ASM policy and related configuration is only taking effect on the virtual servers it is applied on.

So if it is having side effect on pool member outside of the one you wish, it is probably they are embedded on a virtual server you affect the configuration to. In that case, you could use the LTM policies to refine the URL and then pool member that are affected by the ASM policy.

Cheers

Sam

Not so. I mean, after my computer IP attacks this vs, other computer IP's normal access to this vs is also blocked. Why is this

Ok, I realize i did not understand you were speaking about client sharing the same subnet, not servers.

From my understanding, the CSRF blocking you configured is matching normal application trafic. It's hard to explain why without more detail on your configuration and application.

Cheers,

Sam

when 192.168.1.21  attack  vs,blocking,this right

_0-1646726709911.png

_1-1646726911427.png

but,when another ip 192.168.1.61 ,normal access to this url is also blocked,Why is that?

_2-1646726964987.png

 

I never go deep into csrf protection with F5 actually. Looking a this page could be a good start : https://support.f5.com/csp/article/K11930

CSRF violations

When the system detects a CSRF attack on a protected page, such as a request for a URL that does not include the appropriate token, the system issues a CSRF attack detected violation. 

To prevent token hijacking, the system also supports token aging. If the token is expired, the system issues a CSRF authentication expired violation.

Looking at your URL, there is no token in the URL of the request that are send when you send ant attack, and there is one when you send a legitimate request. When it could be related to expiration in this token.

Cheers,

Sam

Sorry, there is still no suitable solution

This my policy's setting

_0-1646727195590.png

_1-1646727311385.png

 

 

10 seconds as expiration time is too short for a human i think, set at least 5 minutes if there is a form to fill,

Cheers

Sam

不是因为时间。我试过了。即使我给 500 秒,它仍然会拦截正常的请求