Forum Discussion

ErkkiS_295148's avatar
ErkkiS_295148
Icon for Cirrus rankCirrus
Sep 28, 2017

f5 asm login pages / brute force detection header value

Hello,

 

I am trying to configure brute-force prevention and login pages. I have a header value that is set when the login fails on the specified login URL: "login-failed: true".

 

When the login succeeds there is no header like "login-failed: false" or "login-successful: true"

 

The problem is that the signon page is used for many different apps and this is the only thing that is in common for them all when the login fails.

 

 

Seems the "String that should not appear" is only scanning for body text so detecting failed logins is not working.

 

Are the only ways to make this work to tell the application guys to add "login-failed: false" or "login-succesful: true" header?

 

ASM Advanced WAF
security

1 Reply

Sort By
  • Chris_Grant's avatar
    Chris_Grant
    Icon for Employee rankEmployee
    Oct 04, 2017

    The application would need to have a header or string that signified a successful login for you to be able to use a header. We support the use of a header to signify success, but not to signify failure. We tend to assume failure until shown success. You can always open a support case and make a Request For Enhancement (RFE). We can send that to PD and request this feature, but can't guarantee when it might be implemented (or even if).