Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

kunalPatel_3157's avatar
8 years ago

Configuring cookie encryption within the HTTP profile

K14784: Configuring cookie encryption within the HTTP profile (10.x - 12.x)

 

Followed this Not able to encrypt cookies any thoughts?

 

Running on 11.4

 

2 Replies

  • Kunal,

     

    Can you share your http profile configuration from command line using (/S1-green-P:Active)(/Common)(tmos) show running-config ltm profile http name .

     

    And you can trying link text for encrypting and decrypting cookie using irule.

     

  • Hello Kunal,

    Can you confirm that you entered the Cookie Encryption Passphrase after entering the appropriate cookie name under 'Encrypt Cookies' option within the HTTP profile? Without the passphrase being in place, you won't see the cookies being encrypted.

    If both these settings are in place, then can you return the output you see for the following command in your command line:

    egrep '^ltm profile http|encrypt-cookie' bigip.conf
    

    For example, this is what I see when I run this command in my lab unit that contains the passphrase as well as the cookie name "foo":

    egrep '^ltm profile http|encrypt-cookie' bigip.conf

    ltm profile http /Common/custom-http {
        encrypt-cookie-secret $M$2p$r+mlhEDU9JUdh7R6T80nDg==
        encrypt-cookies { foo }