Aurel
Jun 26, 2019Cirrus
Unparsable request content - which security tradeoff ?
Hello all,
I am facing a violation for URL length exceeding the default ASM (2048) value.
Options to deal with this seems to be :
- increasing the whole system variable value of 2048
- Disable the HTTP compliance check "Unparsable request content" that implies removal of several others HTTP checks for the whole policy.
- Disabling ASM for the specified URI
What do you think that would be the best security tradeoff ?
Having no ASM at all for an URI, or releasing some HTTP checks on the whole policy ? or increasing default system value and then increasing ASM load.
thanks a lot for any thought