Cookie encryption/decryption using iRule

First, I'd look at the the sample code on encrypting cookies

 

 

http://devcentral.f5.com/wiki/default.aspx/iRules/EncryptingCookie.html

 

Click here

 

 

As for determining whether a cookie has been encrypted, you could try one of these ways:

 

 

1) Extract the value cookie from the server and prefix it with something unique (ie. "enc:". Then encrypt that value. On the next request, look for your cookie and decrypt it. If it starts with your known string "enc:", remove the prefix (with substr) and pass it to the server. If it doesn't start with "enc:" pass the original value to the server.

 

 

2) Mask the backend cookie with your own cookie name. Let's say the backend cookie is called "MyCookie". On the Response you extract that value and create an encrypted cookie called something else like "MySecuredCookie" and remove the original "MyCookie". Then on the next request, look for the "MySecuredCookie" and decrypt it and stuff the decrypted value into a new "MyCookie" and remove the encrypted "MySecuredCookie".

 

 

Just a few things that popped into my head. I'm sure there are others as well.

 

 

Let us know how it goes and what you end up using. That would make a good addition to the CodeShare.

 

 

-Joe