Last Modified: Apr 28, 2025
Affected Product(s):
BIG-IP ASM
Known Affected Versions:
11.3.0, 11.4.0
Fixed In:
11.5.0, 11.4.0 HF3, 11.3.0 HF8
Opened: Jun 29, 2013 Severity: 3-Major Related Article:
K81082731
Proxy is waiting for connection to be closed before sending response to client.
When the ASM generates this response, it does not close the connection. This impacts the proxy servers in that they wait for a FIN before sending this response to the client browsers.
This issue occurs when all of the following conditions are met: -- The BIG-IP ASM system is configured for Web Scraping Anomaly Detection. -- A proxy is configured between the client and the BIG-IP ASM system. -- The BIG-IP ASM system generates a Client Side Integrity Check response following a request with a Connection: close header from the proxy.
This issue has no workaround at this time.
The system now correctly closes the connection after the system generates a client-side integrity check response, and the original request had a "Connection: close" header. In this case, BIG-IP also adds the "Connection: close" header to the client-side challenged response.