F5 Networks

Overview

F5 Networks is an enterprise application delivery and security company headquartered in Seattle, Washington. Its portfolio spans web application firewalls (WAF), DDoS protection, bot management, load balancing, and SSL/TLS offloading. When F5 scripts appear in the browser, they are typically components of F5's Shape Security or Distributed Cloud Bot Defense products — client-side JavaScript challenges that assess whether a visitor is a human or an automated bot. These scripts are deployed by enterprises, financial institutions, and e-commerce companies to protect login pages, checkout flows, account creation forms, and APIs from credential stuffing, carding, and scraping attacks.

What This Script Does

Script Files and Domains

F5 Shape Security/Bot Defense injects a dynamically generated JavaScript file — the filename and content are intentionally obfuscated and rotated to resist reverse engineering. Common patterns include files loaded from the site's own domain (to avoid ad blocker blocking) or from api.figtreesecurity.com, api.bcrf.net, or F5-provisioned subdomains of the customer's own domain. Bot Defense scripts communicate with F5's telemetry collection endpoints at {customer-prefix}.shape.io or via proxied routes on the origin server.

Browser Signal Collection

The script performs an extensive battery of passive browser and environment checks to generate a risk signal:

• Navigator properties: userAgent, platform, hardwareConcurrency, deviceMemory, language, languages, maxTouchPoints, vendor, appVersion
• Screen properties: width, height, colorDepth, pixelDepth, availWidth, availHeight
• Canvas fingerprinting: Renders an offscreen canvas with text and geometric shapes, reads the pixel buffer as a hash
• WebGL: Queries renderer and vendor strings from the GPU
• Audio fingerprinting: Uses the AudioContext API to generate a device-specific audio processing signature
• Timing: Measures JavaScript execution timing to detect headless browser anomalies
• Behavioral signals: Tracks mouse movement velocity, keystroke timing intervals, touch event patterns, and scroll behavior
• Plugin and font enumeration: Lists available browser plugins and measures font rendering metrics

Risk Score and Challenge

Collected signals are encoded and transmitted to F5's scoring infrastructure, which returns a risk verdict. High-risk sessions may be presented with a CAPTCHA challenge or silently blocked at the WAF layer. Low-risk sessions receive a signed token that is validated server-side on subsequent requests.

Cookies Set

F5 Bot Defense sets session-scoped cookies (names vary by deployment) to persist the risk verdict across page navigations, avoiding repeated challenge overhead. These cookies contain encrypted risk scores and session tokens — no persistent advertising identifiers.

Consent & Compliance

Category: Essential

Bot management and fraud prevention are recognized as legitimate interests and strictly necessary security functions under ePrivacy. The EU's ePrivacy Directive (Article 5(3)) exempts cookies that are "strictly necessary in order to provide an information society service explicitly requested by the subscriber or user." Security scripts that protect the integrity of a requested service — such as preventing credential stuffing on a login page or carding on a checkout page — fall squarely within this exemption.

Under GDPR Recital 47, processing for fraud prevention constitutes a legitimate interest that overrides the data subject's interest where processing is proportionate. F5's client-side signals collection during a transaction flow is proportionate to the fraud risk being mitigated.

CCPA similarly exempts fraud prevention data processing from opt-out requirements under the "security" exception (Cal. Civ. Code § 1798.145(a)(1)).

No consent is required for strictly necessary security scripts, provided their scope is limited to security functions and they do not run persistent advertising tracking in parallel.

Should You Block This Without Consent?

No. F5 Networks' bot defense and WAF scripts provide essential security protection — preventing automated attacks, credential stuffing, carding, and DDoS — during user-requested interactions. They qualify for the strictly necessary exemption under ePrivacy and represent a legitimate interest under GDPR. Blocking them would expose your site to significant fraud and abuse risk. Ensure these scripts are scoped to pages where security protection is needed (login, checkout, registration) rather than running site-wide if minimizing data collection is a priority.