The F5 BIG-IP appliance must be configured to limit authenticated client sessions to initial session source IP.
An XCCDF Rule
Description
<VulnDiscussion>The "Restrict to Single Client IP" is a safeguard against session hijacking or cookie theft. Even if an attacker manages to steal a session cookie, the cookie cannot be used from a different source IP address that the address used to initiate the session. This security measure is set within the APM Access Pro?les. Sites should test this setting within their network prior to implementing. Users behind a shared proxy address may be denied access. Optionally, the F5 BIG-IP APM can be installed and used to produce access reports to find recurring IP sources within the user community.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-260055r947390_rule
- Severity
- Low
- References
- Updated
Remediation - Manual Procedure
Note: Implementation is OPTIONAL. Setting should be tested to ensure that a denial of service (DoS) does not result.
From the BIG-IP GUI:
1. System.
2. Access.
3. Profiles/Policies.