Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Session Token in URL

Elefterios | Last updated: Apr 15, 2021 04:05PM UTC

This vulnerability was generated by a response from and an F5. I am getting these quite often as more of the customers are using this technology. We have talked to their development team, and the Burp scanner is creating the message after scanning. The report will display: HOST - url PATH - /my.policy_nonce The my.policy is hosted by preventing unauthorized users from entering the network. The '_nonce' is not hosted by the customer. Would this be a false positive generated by Burp? Why is this happening and how can it be remediated in order to pass the information to the customer?

Uthman, PortSwigger Agent | Last updated: Apr 16, 2021 06:19AM UTC

Hi Elefterios, If you select 'Minimize false positives' in your Audit configuration > Audit Optimization > Audit accuracy and run the scan again, is the issue still reported? Can you please share screenshots of the issue, the scan task, and diagnostics to support@portswigger.net?

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.