Forum Discussion

Boris_Rousseau_'s avatar
Boris_Rousseau_
Icon for Nimbostratus rankNimbostratus
Jun 09, 2010

Json & ASM

Hello, Is my BIG-IP ( 9.4.7 Build 330.0 Hotfix HF2 ) able to handle Json requests ? As Json post content is not structured ( {"param1":1,"param2":2} ) as classical http/html (param1=1&param2=2 ...), i am not sure BIG-IP will be able to isolate params/values Best regards
APM
app sec
security

3 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jun 09, 2010
    Hi Boris,

     

     

    I think ASM is hardcoded to parse URL encoded parameters as URL encoded parameters. What content type does a JSON request use? Chances are ASM won't be able to parse them, but I'm curious to know. Can you post an anonymized request?

     

     

    Aaron

     

     

  • Boris_Rousseau_'s avatar
    Boris_Rousseau_
    Icon for Nimbostratus rankNimbostratus
    Jun 10, 2010
    Hi Aaron, Here is the blocked request: Alert : Illegal parameter Yes REQUEST : POST /ServiceHost/services/CostService.svc/CostOfSandwiches HTTP/1.1 Content-Type: application/json POST CONTENT: {"quantity":3,"unit_price":1.25} RESULT: Parameter Name=Value Parameter Violations Parameter Level {"quantity":3,"unit_price ":1.25}= Illegal parameter The problem is the f5 handle '{"quantity":3,"unit_price ":1.25}' as a unique parameter. The expected behavior would have been to handle quantity & unit_price as two separates parameters...
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jun 10, 2010
    I don't think ASM will be able to handle parameters that aren't in a URL encoded format (param1=value1&param2=value2, etc). Imperva handles this well with an ability to rewrite post data just for evaluation (with no change made to the actual payload). The only thing I can suggest is that you open a request for enhancement with F5 Support on this.

     

     

    Aaron