Forum Discussion

gavin84_31753's avatar
gavin84_31753
Icon for Nimbostratus rankNimbostratus
Dec 07, 2012

Secure and HTTP attribute setting on BIGIP cookie in Persistence Profile

So I'm in need of an IRULE to set HTTP Only and secure flags on the cookie that we are using in our cookie persistence profile, call it BIGIP. I did some research and found this one on dev central, however it broke some other cookie domains. I really just need to have only 1 cookie configured for secure/httponlly

 

 

when HTTP_RESPONSE {

 

set myValues [HTTP::cookie names]

 

foreach mycookies $myValues {

 

if { [HTTP::cookie expires $mycookies] eq "" }{

 

set mypath [HTTP::cookie path $mycookies]

 

set myvalue [HTTP::cookie $mycookies]

 

HTTP::cookie remove $mycookies

 

HTTP::cookie insert name $mycookies value $myvalue version 1

 

HTTP::cookie httponly $mycookies enable

 

HTTP::cookie secure $mycookies enable

 

if { $mypath ne "" } { HTTP::cookie path $mycookies $mypath }

 

}

 

else { HTTP::cookie secure $mycookies enable }

 

}

 

}

 

 

 

What can I do here? Any help would be appreciated.

 

 

Thanks,

 

Gavin

 

application delivery
dev
devops
iRules

3 Replies

Sort By
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Dec 08, 2012
    Taking inspiration from the following thread (https://devcentral.f5.com/community/group/aft/1178831/asg/52), here's a simple iRule that should get you in the right direction. 

    
when RULE_INIT {
    set static::DEBUG 1
}
when SERVER_CONNECTED {
     Save the name of the currently connected pool (remove "/Common/" for v11 systems)
    set pool_name [findstr [LB::server pool] "/Common/" 8]
    if { $static::DEBUG } { log local0. "pool = $pool_name" }
}
when HTTP_RESPONSE {
     Check if the response contains the persistence cookie
    if { [HTTP::cookie BIGipServer${pool_name}] ne "" }{
        if { $static::DEBUG } { log local0. "BIGIP cookie exists: [HTTP::cookie BIGipServer${pool_name}]" }
         Replace the last Set-Cookie header value with the same value with HttpOnly and secure appended
        HTTP::header replace Set-Cookie "[HTTP::header Set-Cookie]; httponly; secure"
    }
}

  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jun 18, 2013
    In v11.0 you can use 'HTTP::cookie httponly $cookie_name enable' to set this flag:

    https://devcentral.f5.com/wiki/iRules.http__cookie.ashx 

    
when HTTP_RESPONSE { 
 
 Check if the response contains the persistence cookie 
if {[HTTP::cookie BIGipServerMy_Http_Pool] ne ""}{ 
 
 Set the httponly flag on the persistence cookie if it is in the response
HTTP::cookie httponly BIGipServerMy_Http_Pool enable
} 
}

    Aaron
  • galky_104921's avatar
    galky_104921
    Icon for Nimbostratus rankNimbostratus
    Jan 14, 2014

    It is not working as bigip cookie is version 0 and you get version error. When you try to set the bigip persistence cookie the version - you get illegal attribute error.