Updated Date: 07/07/2026
About configuring SSRF
To enable the SSRF functionality, the parameter which carries the IP addresses or domain names must be configured as a parameter of data type URI.
The F5 Application Security Manager (ASM) allows the user to configure the disallowed domain names and IP addresses such that if any of such URI parameter contains configured entries, then the ASM will block the traffic and raise a violation server-side access to disallowed host.
Also, the ASM will block the request and raise a violation illegal parameter data type if any of the following condition is met:
-
If IP address as URI is received, when Is IP address field in unchecked.
-
If host name as URI is received, when Is IP address filed is checked.
-
If an invalid host name or IP address is received.