Forum Discussion
Cookie Encryption in a high volume environment
Hi, We would like to know if anyone has used i-rule crypting API to encrypt/decrypt cookie content in a high volume environment (120-130 transactions per second). The following code works well however, will it perform efficiently with tons of traffic? Any benchmarking data or comments would be appreciated.
when RULE_INIT {
Log debug messages to /var/log/ltm? 1=yes, 0=no.
set ::debug 1
set ::cookie "myCookie"
key for use in encryption/decryption operations.
set ::key [substr [AES::key 128] 8]
set ::iv [substr [AES::key 128] 8]}
when HTTP_RESPONSE { if {[string length [HTTP::cookie value $::cookie]] > 0}{ Log the original cookie value from the app if {$::debug}{log local0. "\Response from app contained our CRYPTO cookie: [HTTP::cookie value $::cookie]"} set cookie_admin [HTTP::cookie value $::cookie] set encrypted_cookie [CRYPTO::encrypt -alg aes-128-cbc -keyhex $::key -ivhex $::iv $cookie_admin] set encoded_cookie [b64encode $encrypted_cookie] log local0. "CRYPTO $cookie_admin encryption : $encrypted_cookie" log local0. "CRYPTO encoded_cookie : $encoded_cookie" HTTP::cookie remove $::cookie HTTP::cookie insert name $::cookie value $encoded_cookie } }
when HTTP_REQUEST { log local0. [HTTP::uri] If the cookie exists with any value, for any requested object, try to decrypt it if {[string length [HTTP::cookie value $::cookie]]}{ set cookie_admin [HTTP::cookie value $::cookie] if {$::debug}{log local0. "\Request to app contained our CRYPTO cookie: $cookie_admin"} set decoded_cookie [b64decode $cookie_admin] set decrypted_cookie [CRYPTO::decrypt -alg aes-128-cbc -keyhex $::key -ivhex $::iv $decoded_cookie] log local0. "CRYPTO decoded_cookie : $decoded_cookie" log local0. "CRYPTO decrypted_cookie : $decrypted_cookie" HTTP::cookie remove $::cookie HTTP::cookie insert name $::cookie value $decrypted_cookie } else { Cookie wasn't present in the request } }
1 Reply
- IheartF5_45022
Nacreous
Hi - I would just do it in a custom HTTP profile which would be more efficient than an iRule.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com