Training and CyberInsights Today

F5 ASM

17 lessons · Beginner to advanced

Policies, staging, learning, signatures, tuning, API security, logs and recovery.

F5 ASM training →

FortiWeb

17 lessons · Beginner to advanced

Server policies, profiles, ML, signatures, APIs, troubleshooting and HA.

FortiWeb training →

How to use the WAF training hub

CyberInsights Today

Daily cybersecurity analysis and practical bulletins

Understand recent vulnerabilities, threats, their impact and mitigation. When there is no worthwhile new issue, learn a security concept or defensive practice through clear explanations, illustrations and evidence.

Read CyberInsights Today →

Lesson 12: Login Protection, Sessions, Cookies and CSRF

F5 ASM CLASSROOM • LESSON 12

Level: Intermediate to advanced  |  Suggested study and lab time: 75 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP

Start Here / Course Guide · All lessons

Protect a workflow, not just a page

Login protection requires understanding how the application authenticates a user and reports success or failure. A URL named /login tells you very little by itself. Some applications return HTTP 200 for both outcomes, use redirects, or authenticate through an external identity provider.

Separate the threats

Brute force involves repeated attempts to guess credentials. Credential stuffing uses credentials stolen elsewhere. Session hijacking abuses an existing authenticated session. Cross-site request forgery (CSRF) tricks a user's browser into submitting an unwanted authenticated action. These threats need different controls and cannot be solved by one generic “login security” switch.

Model login behavior

Record the login URL, method, username field, session behavior, and reliable success/failure indicators. For a supported login-page configuration, use indicators that match the application. Incorrect detection can classify normal logins as failures or miss attacks. Available brute-force, device, and session capabilities depend on your license and release.

Guided lab

  1. Create synthetic users in your isolated application and verify account recovery works.
  2. Record one successful and one unsuccessful login using sanitized requests and responses.
  3. Configure the supported login-page detection settings based on those observations.
  4. Begin with observation where supported. Confirm that the system distinguishes success and failure correctly.
  5. Run a small, bounded set of failed logins agreed for the lab. Record the detection period and threshold you selected; these are lab values, not production recommendations.
  6. Inspect the events, then test successful login and recovery after mitigation ends.
  7. Check the effect on two synthetic users sharing a source address to understand the risk of IP-based treatment.

Expected result: failed attempts are classified accurately, the intended response occurs, and ordinary users can still sign in. Stop the test if you cause unintended lockout.

Understand CSRF

A browser may automatically attach session cookies to requests. CSRF defenses help verify that a state-changing request belongs to the intended application interaction. Application anti-CSRF tokens, suitable cookie settings, and origin-related checks form part of the design. Where using ASM CSRF features, verify their documented prerequisites and behavior for your version.

Browser-oriented protections can depend on inserted cookies, tokens, or page processing. APIs, mobile clients, cross-domain flows, and modern frontends may behave differently. Test them explicitly. CORS settings are not a universal substitute for CSRF protection or authorization.

Mini-exercise

Draw the journey from login to adding a delivery address to logout. Mark which requests change state, what proves identity, and what proves that each action is authorized. Identify where a CSRF defense is expected.

Knowledge check

Why can blocking one IP after repeated failures affect innocent users?

Instructor answer

Many users can share an outward-facing address through NAT or a proxy. An IP is not a unique user identity. Select and test supported detection and mitigation scopes with that limitation in mind.

Further reading

Independent educational material. Menus, defaults, and feature availability vary by BIG-IP release and license. Use the documentation for your installed version. Perform exercises only in your authorized lab. Examples and expected results are instructional; these labs have not been executed on a BIG-IP device for this blog.

← Previous lesson · Course guide · Next lesson →

Comments

Post a Comment

Popular posts from this blog

PHP2Shell Explained: Impact, Patches and Mitigation for CVE-2026-109618 and CVE-2026-109619

By Harpreet Singh Virdi, CISSP, CCSP · Cybersecurity Updates Published and evidence checked: November 3, 2026. If you run PHP, start with an inventory and a patch decision today. If a security appliance uses PHP internally, check its vendor advisory too. Updating your website code alone does not update the runtime inside a firewall. PHP2Shell is the name used for CVE-2026-109618 and CVE-2026-109619. They can allow remote code execution without authentication. PHP released security updates on October 21. The PHP team identifies web-serving installations as at risk and highlights Apache mod_php as the highest-risk configuration. PHP security announcements .
Read more

Start Here: F5 ASM Classroom — From Beginner to Advanced

WELCOME TO YOUR ONLINE CLASSROOM Learn F5 ASM, one clear lesson at a time. A practical English-language course for beginners, progressing to advanced policy operations. Instructor: Harpreet Singh Virdi, CISSP, CCSP Start here — you do not need prior ASM experience If the words “security policy,” “staging,” and “learning suggestion” feel unfamiliar, you are in the right place. We will explain them carefully, follow a web request through BIG-IP, and build a policy around a fictional online bookshop. F5 ASM means BIG-IP Application Security Manager. It inspects application traffic against configured security checks. The course explains how to use those checks, investigate their results, and protect legitimate user journeys. Advanced WAF terminology also appears; feature availability depends on your release and license. How to take this course Read the lessons in numerical order. Each is a separate blog post. Learn the terms, then work through the example before changing settings. Use an ...
Read more

Lesson 01: What Is F5 ASM? Your First Web Application Firewall Class

F5 ASM CLASSROOM • LESSON 01 Level: Beginner  |  Suggested study and lab time: 30 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP Start Here / Course Guide · All lessons Welcome to class Imagine running an online bookshop. Your website must accept searches, logins, and orders from people you have never met. The same public entrance also receives malformed requests and attempts to exploit software weaknesses. How do you distinguish a normal search from a suspicious request? A web application firewall (WAF) examines web traffic using rules about the application and patterns associated with attacks. F5 BIG-IP Application Security Manager, usually called ASM , is a WAF capability on the BIG-IP platform. Our task is to understand the traffic, define appropriate checks, investigate the results, and enforce protection without unnecessarily disrupting legitimate users. What you will learn Explain the purpose of a WAF in your own words. Identify where ASM fits in a web reque...
Read more