For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

AshuA_246482's avatar
AshuA_246482
Icon for Nimbostratus rankNimbostratus
Nov 30, 2017

adding httponly flag in rule breaks the website

When i apply a irule on https-VIP to add httponly flag for all cookies, the site stop working. Any idea ? i_rule : when HTTP_RESPONSE { foreach mycookie [HTTP::cookie names] { HTTP::cookie http...
application delivery
LTM
eey0re_68979's avatar
eey0re_68979
Icon for Altocumulus rankAltocumulus
Dec 01, 2017

The 

HttpOnly
flag on a cookie means that the cookie is not visible to any JavaScript which runs in the browser. If setting it breaks your site, then that cookie must be used by scripts on the page.

Further reading: OWASP, MDN.