Learn F5 Technologies, Get Answers & Share Community Solutions Join DevCentral

Filter by:
  • Solution
  • Technology
Clear all filters
Answers

HTTP parser violation

Hi

I am getting the above violation for a particular url as it exceeds the default url length of 2048 . Can i write a irule telling if that particular url is seen , then to unblock the traffic ? because the other option is to change the system variable which will impact the othe policies and i dont need that. Also i dnt want to uncheck the http parser violation blocking setting as well.

when ASM_REQUEST_DONE {

if { [HTTP::uri] contains "/abc" && [ASM::violation attack_types] equals "ATTACK_TYPE_HTTP_PARSER_ATTACK" } { 

        ASM::unblock 
    } 
0
Rate this Question

Answers to this Question

placeholder+image
USER ACCEPTED ANSWER & F5 ACCEPTED ANSWER

Hey Draco, Yes, you are correct, this will be the way to go about it, and it seems you have the right violation description. Matching that with the specific URL should give you the control that you need.

0