Forum Discussion

L-CISIRH-BT-NET's avatar
L-CISIRH-BT-NET
Icon for Nimbostratus rankNimbostratus
Nov 02, 2018

CSRF protection blocks the whole website instead of csrf attacks only

Hi everybody Working on a VE 11.5.4 I need to activate the CSRF protection that my application does not provide.   The pb is that once activated, ASM blocks everything instead of a real attack. So...
ASM Advanced WAF
security
samstep's avatar
samstep
Icon for Cirrocumulus rankCirrocumulus
Nov 04, 2018

First of all you need to make use you use CSRF only on URLs which need it (have CSRF vulnerability e.g. transactions) and these URLs to the Protected URLs list in ASM CSRF screen.

 

Secondly:

 

Version 11.5.4 has a known CSRF bug (ID474256) causing False Positive, more information here

 

https://cdn.f5.com/product/bugtracker/ID474256.html

 

So if you are affected (CSRF protection is needed in frames) then you need to upgrade to v12.x