# Bypassing WAFs with the phantom $Version cookie

DevFeed: [Bypassing WAFs with the phantom $Version cookie](<https://devfeed.tech/articles/bypassing-wafs-with-the-phantom-version-cookie-7669.md>)

Original publisher: [Read original article](<https://portswigger.net/research/bypassing-wafs-with-the-phantom-version-cookie>)

Author: Zakhar Fedotkin

Published: 2024-12-04T15:03:35Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [Parsing](<https://devfeed.tech/topics/parsing.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Cross-origin resource sharing (CORS)](<https://devfeed.tech/topics/cors.md>), [Spring Boot](<https://devfeed.tech/topics/spring-boot.md>), [Python](<https://devfeed.tech/topics/python.md>), [Flask](<https://devfeed.tech/topics/flask.md>), [Django](<https://devfeed.tech/topics/django.md>)

Tags: [cookies](<https://devfeed.tech/tags/cookies.md>), [django](<https://devfeed.tech/tags/django.md>), [flask](<https://devfeed.tech/tags/flask.md>), [http](<https://devfeed.tech/tags/http.md>), [parsing](<https://devfeed.tech/tags/parsing.md>), [python](<https://devfeed.tech/tags/python.md>), [security](<https://devfeed.tech/tags/security.md>), [spring-boot](<https://devfeed.tech/tags/spring-boot.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

This article explains how differences between HTTP cookie parsers can be exploited to bypass web application firewalls. It examines legacy cookie features such as the phantom $Version attribute, quoted values, and octal escape sequences, with examples from Spring Boot, Apache Tomcat, and Python frameworks including Flask and Django.

## Source excerpt

HTTP cookies often control critical website features, but their long and convoluted history exposes them to parser discrepancy vulnerabilities. In this post, I'll explore some dangerous, lesser-known