Bug ID 424264: BIG-IP ASM web scraping may fail to close client-side connections

Last Modified: Apr 28, 2025

Affected Product(s):
BIG-IP ASM(all modules)

Known Affected Versions:
11.3.0, 11.4.0

Fixed In:
11.5.0, 11.4.0 HF3, 11.3.0 HF8

Opened: Jun 29, 2013

Severity: 3-Major

Related Article: K81082731

Symptoms

Proxy is waiting for connection to be closed before sending response to client.

Impact

When the ASM generates this response, it does not close the connection. This impacts the proxy servers in that they wait for a FIN before sending this response to the client browsers.

Conditions

This issue occurs when all of the following conditions are met: -- The BIG-IP ASM system is configured for Web Scraping Anomaly Detection. -- A proxy is configured between the client and the BIG-IP ASM system. -- The BIG-IP ASM system generates a Client Side Integrity Check response following a request with a Connection: close header from the proxy.

Workaround

This issue has no workaround at this time.

Fix Information

The system now correctly closes the connection after the system generates a client-side integrity check response, and the original request had a "Connection: close" header. In this case, BIG-IP also adds the "Connection: close" header to the client-side challenged response.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips