Forum Discussion

Walter_Kacynski's avatar
Walter_Kacynski
Icon for Cirrostratus rankCirrostratus
Mar 09, 2016

APM SessionCookie MRHSession and CSRF

Does the APM MRHSession Cookie have any protections against a CSRF based attack?   If we have a Spring application behind APM, do I need to worry about CSRF at the application level? http://docs.s...
APM
application delivery
ASM Advanced WAF
security
Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Mar 09, 2016

Hi Walther,

the MRHSession session cookie is used for APM per-request authorization.

So the cookie "as is" can't be used to protect against CSRF attacks, if the user remains logged on. You'll would need additional iRule codings to use this cookie to protect against CSRF attacks (e.g. STREAM inject the MRHSession cookie value as a hidden

to your pages). But doing so would introduce additional risks to the MRHSession cookie, so better use an independent and randon cookie value for CSRF mitigation).

Cheers, Kai