---
id: 5050
title: "Bypassing WAFs with the phantom $Version cookie"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/bypassing-wafs-with-the-phantom-version-cookie"
published_at: "2025-06-30 16:01"
tags: ["web-security", "cookies", "waf-bypass", "django", "parser-discrepancies", "spring"]
phying_url: "https://phying.com/item/5050"
lang: en
---

# Bypassing WAFs with the phantom $Version cookie

## Summary

Legacy $Version cookies downgrade parsers into RFC2109 mode, and frameworks — Flask, Django, PHP, Spring — disagree on the result. The discrepancies can be abused to smuggle attacks past WAFs.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-06-30 16:01
- **Original:** https://portswigger.net/research/bypassing-wafs-with-the-phantom-version-cookie
- **Phying News:** https://phying.com/item/5050