Forum Discussion

AshuA_246482's avatar
AshuA_246482
Icon for Nimbostratus rankNimbostratus
Nov 30, 2017

adding httponly flag in rule breaks the website

When i apply a irule on https-VIP to add httponly flag for all cookies, the site stop working. Any idea ? i_rule : when HTTP_RESPONSE { foreach mycookie [HTTP::cookie names] { HTTP::cookie http...
application delivery
LTM
eey0re_68979's avatar
eey0re_68979
Icon for Altocumulus rankAltocumulus
Nov 30, 2017

The 

HttpOnly
flag on a cookie means that the cookie is not visible to any JavaScript which runs in the browser. If setting it breaks your site, then that cookie must be used by scripts on the page.

Further reading: OWASP, MDN.