Brian_107072
Nov 04, 2010Nimbostratus
BigIP does not encrypt application cookies
Greetings,
I have an LTM on v9.4.8
I have been fighting this for a week now. I hope someone can shine a light on where I am going wrong.
I have already tried both of the examples in the following link:
http://devcentral.f5.com/wiki/default.aspx/iRules/EncryptingCookies.html
and
http://devcentral.f5.com/Forums/tabid/1082223/asg/50/showtab/groupforums/aff/5/aft/19364/afv/topic/Default.aspx
The problem is that an application is leaking internal network info in a cookie like the following value:
Cookie Value: https%3A%2F%2Fsome.server.com%3A8443%2Fauth%2FUI%2FLogin
I need to encrypt these cookies.
Here is my code:
when CLIENT_ACCEPTED {
set ::cookiename "stagingDistAuth"
set ::encryption_passphrase "abcd1234"
}
when HTTP_REQUEST {
set uri https://[getfield [HTTP::host] : 1][HTTP::uri]
if { $uri starts_with "https://some.server.com/auth/" } {
if { [HTTP::cookie exists $::cookiename] } {
set decrypted [HTTP::cookie decrypt $::cookiename $::encryption_passphrase]
if { ($decrypted eq "") } {
Cookie wasn't encrypted, delete it
HTTP::cookie remove $::cookiename
}
}
}
}
when HTTP_RESPONSE {
if { $uri starts_with "https://some.server.com/auth/" } {
if { [HTTP::cookie exists $::cookiename] } {
set encrypted_value [HTTP::cookie encrypt $::cookiename $::encryption_passphrase]
}
}
}
I have tried entering a lot of log messages to debug but nothing showed up except that the cookie is not being encrypted. When I look at the cookie in my browser it is not encrypted.
When I set the cookie value to the encrypted value with a command like the following I get a new cookie by the same name but with a different domain and not secured.
if { $uri starts_with "https://some.server.com/auth/" } {
if { [HTTP::cookie exists $::cookiename] } {
set encrypted_value [HTTP::cookie encrypt $::cookiename $::encryption_passphrase]
set crtrn [HTTP::cookie value $::cookiename $encrypted_value ]
}
}
Any help would be appreciated.