Skip to content
capzy
Login

F5 BIG-IP Advanced WAF

Continue the protected session with F5's trust cookies. Use the document that triggered the BIG-IP WAF check and your session proxy. This cookie flow is separate from Shape's per-request telemetry.

Get the integration code
POST /createTask · example
{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "AntiF5Task",
    "websiteURL": "https://onlineservices.example.gov/login",
    "proxyType": "http",
    "proxyAddress": "123.45.67.89",
    "proxyPort": "8080",
    "proxyLogin": "user",
    "proxyPassword": "pass"
  }
}

Illustrative values. Replace the inputs with values from your current integration.

Protected URL + proxyYour session proxy requiredTS / TSPD cookies + user-agent

Use the URL that triggered the F5 check.

Use the document that triggered the BIG-IP WAF check and your session proxy. This cookie flow is separate from Shape's per-request telemetry.

Your API key authenticates Capzy.
Provider keys, challenge IDs, images, and session values belong inside task.

Copy the document's full URL.

  1. Open the protected login/form page with Network logging enabled and select the request that triggered the F5 check.
  2. Copy its complete Request URL into websiteURL, including the actual form path.
  3. Retain the original form/session state. There is no public CAPTCHA site key required for this task.
Input collection example - replace illustrative values
{
  "websiteURL": "https://example.com/login"
}

Use F5 Shape for protected API telemetry headers; BIG-IP returns a cleared cookie session.

How F5 BIG-IP Advanced WAF works

F5 BIG-IP Advanced WAF (formerly ASM) protects enterprise and government sites with an inline JavaScript challenge plus cookie-state validation. On first request the server seeds partial TS / TSPD cookies and serves an obfuscated bobcmn script. The script decodes a custom-encoded payload, runs the proof computation, and writes the verified token back to the cookie. Subsequent requests carrying the verified cookie pass the WAF. Two variants exist and we auto-detect both. The base variant is the client-side bobcmn proof. The hardened Bot Defense profile (f5_cspm) additionally loads /TSPD/ collector scripts that score the live browser environment (canvas, WebGL, behaviour) and only issues the clearing TSPD_101 cookie after a telemetry round-trip. Both return the same replayable cookie bundle. Note: F5 BIG-IP AWAF is a different product from F5 Distributed Cloud Bot Defense (ex-Shape Security). This solver targets classic AWAF and its Bot Defense profile: government services, banking portals, healthcare logins. Distributed Cloud Bot Defense has its own F5 Shape product guide; use that guide for its dynamic-header flow.

Send the protected websiteURL and your session proxy. We detect the BIG-IP challenge: the base bobcmn proof uses captured-page replay, while the f5_cspm Bot Defense flow runs the collector in a browser through that proxy. We return the TS/TSPD cookie bundle and matching userAgent. Install all returned cookies and reuse that proxy and identity for the protected request. For Distributed Cloud Bot Defense telemetry headers, use the separate F5 Shape product guide.

  • Auto-detects and solves both variants: the base bobcmn challenge and the Bot Defense (f5_cspm) telemetry profile
  • Captures TS<hash> + TSPD_101 + f5avr clearance cookies
  • f5_cspm solves run a real stealth browser and are replay-verified before return
  • Uses your session proxy for coherent BIG-IP challenge solving and cookie replay
  • Base solve 4-8 s; f5_cspm telemetry solve typically under 10 s
  • Cookies are IP + UA bound. Full replay payload returned

Know what goes in.

Choose a field to see its purpose, where to get it, and its place in the request. Optional values omitted from the example can be added when your flow uses them.

Keep your proxy exit and session identity consistent when using this result.

Request authentication

Required task inputs

Optional context

Proxy connection

websiteURL

stringRequired

The F5 BIG-IP-protected page URL

Where it comes from

Copy the full page URL from the address bar or the document request in Network, including the path where this flow runs.

Open the input guide
Example valuehttps://onlineservices.example.gov/login
POST /createTask · selected configuration
{
  "clientKey": "capzy_YOUR_API_KEY",
  "task": {
    "type": "AntiF5Task",
    "websiteURL": "https://onlineservices.example.gov/login",
    "proxyType": "http",
    "proxyAddress": "123.45.67.89",
    "proxyPort": "8080",
    "proxyLogin": "user",
    "proxyPassword": "pass"
  }
}

The selected field is highlighted when present. Preserve the declared value type and current challenge context.

Make your first request.

Create the task, keep its taskId, and poll until status is ready. Then read the selected variant's solution.

More examples
  1. Create the task

    Send clientKey and the selected task to /createTask from your server. Keep the returned taskId.

  2. Wait for the solution

    Send that same key and ID to /getTaskResult. While processing, wait two seconds before checking again. Stop on Ready or an error.

  3. Apply the result

    Merge solution.cookies into the original cookie jar, preserve domain/path, and reuse solution.userAgent through the solving proxy before retrying the protected action.

AntiF5Task · $2.50 / 1,000
solve_f5_bigip.py
import json, os, time
import requests

API = "https://api.capzy.ai"
KEY = os.environ["CAPZY_API_KEY"]
task = json.loads("{\"type\":\"AntiF5Task\",\"websiteURL\":\"https://onlineservices.example.gov/login\",\"proxyType\":\"http\",\"proxyAddress\":\"123.45.67.89\",\"proxyPort\":\"8080\",\"proxyLogin\":\"user\",\"proxyPassword\":\"pass\"}")

def call(path, payload):
    response = requests.post(f"{API}/{path}", json={"clientKey": KEY, **payload}, timeout=30)
    response.raise_for_status()
    data = response.json()
    if data.get("errorId", 0) or data.get("status") == "failed":
        raise RuntimeError(data.get("errorDescription") or data.get("errorCode") or "Task failed")
    return data

created = call("createTask", {"task": task})
for attempt in range(60):
    result = call("getTaskResult", {"taskId": created["taskId"]})
    if result.get("status") == "ready":
        solution = result["solution"]
        print(solution)
        break
    time.sleep(2)
else:
    raise TimeoutError("Task is still processing; keep the taskId to check it later.")

Before runningReplace all illustrative inputs with your captured values. Set CAPZY_API_KEY in your environment. Install requests with pip install requests.

Polling and failuresThe example checks HTTP/API failures, uses 30-second request timeouts, and stops after 60 result checks. Retain taskId if your task is still processing.

Understand what comes back.

Follow this task from creation to completion. Response fields and usage follow your selected request variant.

TS / TSPD cookies + user-agent

Merge solution.cookies into the original cookie jar, preserve domain/path, and reuse solution.userAgent through the solving proxy before retrying the protected action.

array
Array of cookie objects including TS<hash>, TSPD_*, f5avr…_session_
string
User-Agent used — must match when reusing cookies
POST /getTaskResult · example response
{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "cookies": [
      {
        "name": "TSaa03129d029",
        "value": "<long F5 TS verified cookie>",
        "domain": "onlineservices.example.gov",
        "path": "/"
      },
      {
        "name": "TS351d4aa7027",
        "value": "<F5 TS cookie>",
        "domain": "onlineservices.example.gov",
        "path": "/"
      },
      {
        "name": "f5avraaaaaaaaaaaaaaaa_session_",
        "value": "<F5 session id>",
        "domain": "onlineservices.example.gov",
        "path": "/"
      },
      {
        "name": "TSaa03129d075",
        "value": "<F5 verification cookie>",
        "domain": "onlineservices.example.gov",
        "path": "/"
      }
    ],
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
  }
}

Illustrative values. Additional metadata may be returned; only Ready contains a completed solution.

Use the result

Merge solution.cookies into the original cookie jar, preserve domain/path, and reuse solution.userAgent through the solving proxy before retrying the protected action.

Execution context result is the parsed Ready response from the polling example. session, when referenced, is your existing requests.Session (or browser-compatible session) with the original cookie jar, headers, and solving proxy configured in session.proxies for both http and https. Keep this client for the complete flow. task is the task object you submitted. For Shape, action_body is the original protected request body as bytes or a string, with its original Content-Type in session.headers. Install curl_cffi when the fragment imports it; match the target's required browser/TLS identity.

Use the result · Python

sol = result["solution"]
for c in sol["cookies"]:
    session.cookies.set(c["name"], c["value"], domain=c.get("domain"), path=c.get("path", "/"))
session.headers["User-Agent"] = sol["userAgent"]
# Reuse the original session and its configured solve proxy.
resp = session.get("https://target.example.com/", timeout=30)
print(resp.status_code)

When something doesn't work.

Check your captured values, the selected variant, and the response before starting another task.

What's the difference vs Imperva?

Different vendor, different cookies. Imperva uses reese84 / ___utmvc / incap_ses; F5 BIG-IP uses TS<hash> / TSPD_* / f5avr…_session_. Both are JavaScript-challenge-with-cookie-state WAFs — the protocol details differ but the solve shape is similar.

Why are TS cookies short-lived?

F5 commonly sets Max-Age=30 on TS cookies. Replay through the same IP + UA promptly after the solve completes. For long-running flows, re-solve when cookies near expiry.

Do you solve the F5 Bot Defense (f5_cspm) proactive profile?

Yes. When F5 layers the Bot Defense profile (the /TSPD/ collector scripts that score canvas, WebGL and behaviour), we run a real stealth browser through your proxy to pass the telemetry, then return the server-issued TS and TSPD_101 clearance cookies. Each solve is replay-verified before return. This BIG-IP task excludes F5 Distributed Cloud Bot Defense (Shape); use its separate guide at /solvers/f5-shape for the dynamic-header flow.

Does this support F5 Distributed Cloud Bot Defense (Shape)?

This BIG-IP task targets classic Advanced WAF and its f5_cspm profile. For F5 Distributed Cloud Bot Defense telemetry headers, use the separate F5 Shape guide at /solvers/f5-shape.

Connect F5 BIG-IP Advanced WAF to your workflow.

Get your Capzy API key and use this guide's integration.

Get an API key Full API documentation
$2.50Per 1,000 solves
17.8sAverage solve time

AntiF5Task · Live configuration