Lesson 02: HTTP and HTTPS Explained for F5 ASM Beginners

F5 ASM CLASSROOM • LESSON 02

Level: Beginner  |  Suggested study and lab time: 45 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP

Start Here / Course Guide · All lessons

---

Today's objective

Before changing a WAF rule, learn to read the message that triggered it. By the end of this lesson, you should be able to identify a method, hostname, path, parameter, header, cookie, request body, and response status.

Read a request one line at a time

GET /search?q=networking HTTP/1.1
Host: books.example.test
Accept: text/html
Cookie: session=DEMO_ONLY

GET is the method: what operation the client is requesting. /search is the path: which resource it wants. q=networking is a query parameter: input supplied to that resource. Host identifies the requested website. Other headers provide context. The cookie carries a name/value pair previously stored by the browser. This is an illustrative HTTP/1.1 message; HTTP/2 represents messages differently while retaining many of the same concepts.

A login or order might use POST and put input in a body. A JSON request body could contain {"bookId":42,"quantity":1}. The Content-Type header tells the receiver the intended body format, such as application/json. A WAF must parse input appropriately to apply meaningful checks.

Now read the response

HTTP/1.1 200 OK
Content-Type: text/html

A response includes a status, headers, and often a body. The 2xx range generally indicates success, 3xx a redirection, 4xx a client-side request problem, and 5xx a server-side failure. A 403 alone does not prove ASM blocked a request: the application, another proxy, or an access control service may have generated it. Correlate it with the WAF event and application logs.

What HTTPS changes

HTTPS protects HTTP in transit with TLS encryption. ASM needs access to decrypted application traffic to inspect its contents. In a common BIG-IP deployment, a Client SSL profile terminates the browser-side TLS connection. A Server SSL profile can establish a separate encrypted connection to the origin. This is sometimes called TLS bridging. Certificate trust, hostname verification, and protocol settings must be designed for each connection.

If traffic is passed through as encrypted bytes without decryption at the inspection point, the WAF cannot inspect the hidden HTTP payload. Do not confuse “the connection works on port 443” with “ASM can see and inspect the request.”

Instructor demonstration

Open your browser's Developer Tools, choose Network, and load an application you own or are authorized to test. Select a request and inspect its method, URL, headers, and response status. Do not paste session cookies or authorization headers into a public forum or this blog's comments.

Hands-on exercise

1. Record the method and path of the homepage request.
2. Perform a harmless search and identify the parameter that changed.
3. Look for a request with a body and identify its content type.
4. Compare a successful request with a deliberate request to a nonexistent page.
5. Write down which values should be treated as sensitive in logs.

Expected result: you have a small traffic worksheet containing synthetic values, not credentials. If Network appears empty, reopen the page with that panel recording and check whether a filter is hiding requests.

Common mistake

The same input can appear in the query string, a form body, JSON, or a header. A rule scoped to one location may not cover another. Always identify the actual input location before choosing a policy change.

Knowledge check

Why might a WAF receive traffic but fail to inspect the application body?

Instructor answer

The payload may remain encrypted at that point, or the relevant parser/content handling may not be configured as expected. Establish TLS visibility first, then inspect policy and content-type handling.

---

Further reading

• F5 documentation: adding entities to a security policy

Independent educational material. Menus, defaults, and feature availability vary by BIG-IP release and license. Use the documentation for your installed version. Perform exercises only in your authorized lab. Examples and expected results are instructional; these labs have not been executed on a BIG-IP device for this blog.

← Previous lesson · Course guide · Next lesson →