Session Tracking and Session Awareness in F5 ASM/AWAF
F5 ASM/AWAF offers session tracking as part of its security suite, allowing the system to monitor and manage user sessions more effectively. Instead of relying solely on IP addresses (which can be unreliable due to the dynamic nature of IP assignments), session tracking identifies users based on their authenticated session. This is crucial in preventing attacks like session hijacking, brute-force logins, and maintaining the integrity of the user's interaction with the application.
Key Features of Session Tracking:
Session Tracking Based on Authenticated Sessions:
Rather than using IP addresses, which can change or be masked, ASM/AWAF tracks users based on their authenticated session. This provides more reliable tracking of user activity and allows better management of potential threats, especially in environments where IP addresses can be dynamic or spoofed.
Suspicious Session Detection and Management:
Suspicious sessions can be flagged and blocked temporarily or permanently based on defined thresholds for user behavior, such as exceeding a specific number of failed login attempts, high frequency of requests, or other anomaly patterns.
Actions upon violation can include:
Blocking the session entirely.
Logging requests from the suspicious session or IP address for further analysis.
Flexibility in how these violations are handled enables security teams to adjust enforcement actions based on the severity of the situation.
Enabling and Configuring Session Tracking:
To monitor and track user sessions, Session Awareness must be enabled in the security policy. This is done by navigating to:
Application Security > Sessions and Logins > Session Tracking
Once session tracking is enabled, several configurations can be made to manage how suspicious sessions are handled:
Violation Detection Actions:
Block All: If thresholds are exceeded (such as too many failed login attempts or too many requests), all traffic from the violated session or user can be blocked.
Log All Requests: If you prefer not to block the traffic but need to monitor suspicious sessions, you can enable logging for all requests associated with that session or IP. This requires configuring a Logging Profile for the involved Virtual Server (VS).
Delay Blocking: This option allows you to introduce a delay before blocking the suspicious session. This can help in preventing false positives by giving more time to assess the situation.
Session Hijacking Protection:
Session hijacking occurs when an attacker steals an authenticated session (usually via a cookie) to impersonate a legitimate user. F5 ASM/AWAF mitigates this risk by using session fingerprinting.
Session Fingerprinting:
How it works: ASM/AWAF collects information about the client’s environment (such as device type, browser settings, and IP address) using JavaScript. When a legitimate user accesses the application, a unique Device ID is assigned based on these environmental factors.
Session Continuity: On subsequent requests, the system checks the Device ID associated with the session. If the device (or the environment) changes unexpectedly (e.g., a new browser, device, or IP address), the session is flagged as potentially hijacked.
Response Handling:
If an unexpected request (such as one from a different device or browser) is detected, the system may respond with JavaScript that includes a new Device ID, thereby breaking the potential hijacked session and forcing re-authentication or additional verification.
Mitigation of Session Hijacking:
Cookie-based session tracking is crucial in protecting against hijacking, and by using fingerprinting techniques, F5 ASM/AWAF ensures that only the rightful user can continue their session, even if the session cookie is intercepted.
Best Practices for Session Management and Hijacking Protection:
Enable Session Awareness: Ensure that session tracking is enabled and configured properly to detect any unusual or suspicious behavior within user sessions.
Implement Violation Detection Actions: Define appropriate actions like blocking, logging, or delaying blocking based on the severity of session anomalies. Fine-tune the thresholds to minimize false positives while ensuring security.
Monitor Session Patterns: Watch for patterns such as repeated failed login attempts or unusual access times that might indicate a session hijacking attempt.
Session Fingerprinting: Use device fingerprinting to track legitimate users and detect anomalies that could signify session hijacking or bot attacks.
Protect Cookies: Ensure cookies used for session management are set with HttpOnly, Secure, and SameSite flags to prevent them from being accessed or sent in unsafe scenarios.
Re-authentication on Major Changes: Whenever there is a drastic change in session characteristics (e.g., IP address or device change), require re-authentication or additional verification steps to mitigate hijacking risks.
Last updated