Symptoms

Some headers are expected to legitimately contain empty values. There is no option to configure this, which is required in order to define which headers may be sent with an empty value without triggering the empty-value violation, while continuing to enforce the violation on all other headers.

Impact

A legitimate request triggers a violation.

Conditions

-- 'HTTP protocol compliance failed' violation: -- 'Header name with no header value' is enabled. -- A request arrives with a header that has no value.

Workaround

Disable 'HTTP protocol compliance failed' violation: 'Header name with no header value'. Important: This workaround reduces general security. An iRule workaround that uses custom violations and looks into empty headers is possible as well, for example: when ASM_REQUEST_DONE { foreach header_name [HTTP::header names] { if {([HTTP::header value $header_name] eq "") && !($header_name eq "my-allowed-empty-header-name")} { log local0.info "raising EMPTY_HEADER_VIOLATION for header $header_name" ASM::raise EMPTY_HEADER_VIOLATION } } }

Fix Information

Added an internal parameter 'empty_header_value_allowed' that can be configured with a comma-separated list of headers for which an empty value is allowed.

Behavior Change

This release introduces an internal parameter, 'empty_header_value_allowed', which can be configured with a comma-separated list of headers for which an empty value is allowed.