Forum Discussion

Ongko_8903's avatar
Ongko_8903
Icon for Cirrus rankCirrus
Jul 07, 2014

Do anyone know which feature in ASM module inject these scripts and how to change it ?

Dear All,   Recently my company implements AB testing. We embed their script, but there is an error on that script. My vendor said this error occurs because somehow these scripts manipulating m...
ASM Advanced WAF
security
Hans_Schneider2's avatar
Hans_Schneider2
Icon for Nimbostratus rankNimbostratus

For anyone else who comes across this - it took me forever to find this settings because it's pretty buried. There's a few things in ASM that cause javascript injection:

 

  1. CSRF protection
  2. Web-Scraping detection
  3. AJAX blocking

It turns out that this is related to AJAX blocking, as I also had disabled the CSRF protection and I was still getting this injected into my pages, which was breaking a particular browser. When you first go to create your security policy, there's an option that you can check - AJAX blocking response behavior? This is going to inject that javascript in your pages.

 

In ASM 11.6.x, you can disable this setting by going to Security > Application Security > Blocking > Response Pages. Then you select the AJAX Response page from the tabs and uncheck the box.

 

Yes, this even injects the javascript if your policy is set to transparent mode! Yes, it's completely stupid!

 

Hope this helps, it caused me a ton of frustration.

 

ScottyMac_23789's avatar
ScottyMac_23789
Icon for Nimbostratus rankNimbostratus
Dec 09, 2015
Awesome. I had this exact same problem and thought that CSRF was off, but the code was still injected. Changed the suggested AJAX setting and the code was removed. Thanks a ton for your help!