Skip to content
Client-Side Defense

XC Configuration

CSD is already enabled on the demo application. This section shows the configuration screens.

Section titled “Navigate to Client-Side Defense”
  1. Log in to the F5 Distributed Cloud Console
  2. Select the Client-Side Defense workspace
  3. Set the namespace to bot-defense
  4. Navigate to Manage → Configuration
CSD Configuration page showing domain list

Domain Configuration

Section titled “Domain Configuration”

Adding a domain on the CSD Configuration page registers it with the CSD reporting engine. This defines the namespace scope for which CSD gathers and reports telemetry — script detections, alert notifications, and mitigation actions all roll up under the registered domain.

The demo domain (botdemo.sales-demo.f5demos.com) is registered here.

HTTP Load Balancer Method

Section titled “HTTP Load Balancer Method”

The HTTP Load Balancer is where JavaScript injection is configured. This controls whether and where the CSD scripts are inserted into application pages served through the load balancer.

  1. Navigate to Multi-Cloud App Connect → HTTP Load Balancers

  2. Click the … (actions) menu on the load balancer serving the application and select Manage Configuration

    HTTP Load Balancers list showing the demo load balancer

  3. Scroll to the Client-Side Defense section in the left sidebar

    The Client-Side Defense field is set to Enable and the Client-Side Defense Policy shows Configured.

    CSD toggle and settings within the HTTP Load Balancer configuration

  4. Click View Configuration to open the CSD policy details

    The JavaScript Insertion Settings field shows the injection scope. The demo load balancer is set to Insert JavaScript in All Pages.

    JavaScript injection scope in the CSD sub-configuration

Verify Script Injection

Section titled “Verify Script Injection”
  1. Open the demo application in Chrome
  2. Press F12 to open DevTools
  3. Go to the Elements tab
  4. Search for __imp_apg__ or zeronaught in the HTML to locate CSD instrumentation scripts
  5. Confirm one or more CSD <script> tags are present in the <head> — the exact script paths vary by deployment
  6. Confirm the scripts were injected by the load balancer (they are not part of the application source)
Injected scripts in DevTools Elements tab Injected scripts in DevTools Elements tab

The CSD instrumentation scripts are injected by the F5 XC load balancer — they are not part of the application source.