Forum Discussion
Kirk_Bauer_1018
Nimbostratus
NimbostratusCan't get cookie encryption iRule to work
I am running 9.4.3 HF3. I use this iRule in a training class so I'm trying to get it to work even though you can do this in the HTTP profile now. Basically the cookie is encrypted but not decrypted. I'm using the iRule from DevCentral:
when RULE_INIT {
The appliation cookie to encrypt/decrypt
set ::app_cookie "user"
The encryption passphrase. This can be any string.
set ::cookie_passphrase "passphrase123"
Log debug messages to /var/log/ltm? 1=yes, 0=no.
set ::cookie_encrypt_debug 1
}
when HTTP_REQUEST {
Check if the cookie we want to decrypt exists with a value in the request
if {[string length [HTTP::cookie value $::app_cookie]]}{
Decrypt the cookie value and save the output to the variable $decrypted_value
set decrypted_value [HTTP::cookie decrypt $::app_cookie $::cookie_passphrase]
if {$::cookie_encrypt_debug}{log local0. "\decrypted_value: $decrypted_value"}
}
}
when HTTP_RESPONSE {
Check if cookie we want to encrypt exists with a value in the response
if {[string length [HTTP::cookie value $::app_cookie]]}{
Encrypt the cookie value and save the output to the variable $encrypted_value
set encrypted_value [HTTP::cookie encrypt $::app_cookie $::cookie_passphrase]
if {$::cookie_encrypt_debug}{log local0. "\encrypted_value: $encrypted_value"}
}
}
Here are the log entries:
Feb 27 14:37:24 tmm tmm[1656]: Rule Student0_CookieEncryption : encrypted_value: TjRpIjzo7cmDgGUcE0LPqV5ujdsYUjwF8KdzF46zTzwO5CM0NWHM0FmN
Feb 27 14:38:37 tmm tmm[1656]: Rule Student0_CookieEncryption : decrypted_value:
Note how the cookie decrypt returns no value. The cookie is not decrypted in this case and is sent encrypted to the back-end server. Any idea what is wrong?
Nicolas_MenantEmployee
Hi,
The iRule you use doesn't work because on the response it doesn't update the cookie with the new value. You just create the encrypted value and that's it.
If you try to log on the request the content of your cookie $::app_cookie, you'll see it's not encrypted.
You need to use HTTP::cookie $app_cookie $encrypte value to update its content in the response
HTH
hoolioCirrostratus
When I tested (Click here) it looked like HTTP::cookie encrypt/decrypt did modify the cookie value. It was just that the values for HTTP::cookie value $cookie_name were cached.
Kirk, what did you see logged by the rule in the response? On the client, did you see the cookie value encrypted in responses?
Aaron
Kirk_Bauer_1018In my testing the encryption worked perfectly -- the client did get an encrypted cookie value. But the cookie was not decrypted on the return -- the server still saw the encrypted value.