The F5 BIG-IP appliance must be configured to disable the persistent cookie flag.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
low	V-266164	SRG-NET-000233-ALG-000115	F5BI-AP-300153	SV-266164r1024395_rule	2024-09-20	1

Description
For BIG-IP APM deployments with connectivity resources (such as Network Access, Portal Access, etc.), BIG-IP APM cookies cannot be set as Persistent. This is by design since cookies are stored locally on the client's hard disk, and thus could be exposed to unauthorized external access. For some deployments of the BIG-IP APM system, cookie persistence may be required. When selecting cookie persistence, persistence is hard coded at 60 seconds.

Description

For BIG-IP APM deployments with connectivity resources (such as Network Access, Portal Access, etc.), BIG-IP APM cookies cannot be set as Persistent. This is by design since cookies are stored locally on the client's hard disk, and thus could be exposed to unauthorized external access. For some deployments of the BIG-IP APM system, cookie persistence may be required. When selecting cookie persistence, persistence is hard coded at 60 seconds.

ℹ️ Check
If the Access Profile is used for applications that require cookie persistence, then this is not a finding. From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click the access profile name. 5. SSO/Auth Domains tab. 6. Under Cookie Options, verify "Persistent" is disabled. If the F5 Big IP appliance APM Policy has the Persistent cookies flag enabled, this is a finding.

✔️ Fix
Note: Testing must be performed prior to implementation to prevent operational impact. This setting may break access to certain applications that require cookie persistence. From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click the access profile name. 5. SSO/Auth Domains tab. 6. Under Cookie Options, uncheck "Persistent". 7. Click "Update". 8. Click "Apply Access Policy".

✔️ Fix

Note: Testing must be performed prior to implementation to prevent operational impact. This setting may break access to certain applications that require cookie persistence. From the BIG-IP GUI: 1. Access. 2. Profiles/Policies. 3. Access Profiles. 4. Click the access profile name. 5. SSO/Auth Domains tab. 6. Under Cookie Options, uncheck "Persistent". 7. Click "Update". 8. Click "Apply Access Policy".