For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

sundogbrew's avatar
sundogbrew
Icon for Altocumulus rankAltocumulus
Jan 23, 2017

Cookie persistence Irule

Hey Guys, I am having a similar problem to that posted in this link https://devcentral.f5.com/questions/universal-persistence-irule-does-not-appear-to-be-working-50007

So I am working on getting a window to test these Irules written in there. My question is how would I insert a timeout value into those rules?

iRule 1: Creating multiple UIE table entries for each of the cookies

when HTTP_REQUEST {
    if { [HTTP::cookie value "JSESSIONID"] ne "" } then {
        persist uie [HTTP::cookie value "JSESSIONID"]
    }
}
when HTTP_RESPONSE {
    if { [HTTP::cookie exists "JSESSIONID"] } then {
        foreach cookie_value [lsearch -inline -all -glob [HTTP::header values "Set-Cookie"] "JSESSIONID=*"] {
            persist add uie [findstr $cookie_value "=" 1 ";"]
        }
    }   
}

iRule 2: De-duplicating redundant cookies (according to RFC 6265) before executing [persist uie]

when HTTP_REQUEST {
    if { [HTTP::cookie value "JSESSIONID"] ne "" } then {
        persist uie [HTTP::cookie value "JSESSIONID"]
    }
}
when HTTP_RESPONSE {
    if { [HTTP::cookie exists "JSESSIONID"] } then {
        foreach cookie_value [lsearch -inline -all -glob [HTTP::header values "Set-Cookie"] "JSESSIONID=*"] {
            HTTP::cookie remove "JSESSIONID"
        }
        HTTP::header insert "Set-Cookie" $cookie_value
        persist add uie [HTTP::cookie value "JSESSIONID"]
    }
}

Thanks as always! Joe

application delivery
BIG-IP
iRules

4 Replies

  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Jan 23, 2017

    persist uie  []

    persist add   []

    Reference link.

    You can also attach the iRule to a Universal Persistence Profile and configure timeout value in the persistence profile instead of the iRule.

  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Jan 23, 2017

    Joe,

    Timeout value is configured in "persist add uie" command in seconds.

    E.g. when you add a persistence record to the table you define how long it should live there.

    In your case for example for a 10-minute (600 second) timeout : 

    persist add uie [HTTP::cookie value "JSESSIONID"] 600

    Re: persistence not working - make sure you have OneConnect profile enabled on the virtual server. Without it the load-balancing decision is made upon the TCP connection (e.g. way BEFORE any cookies can be read).

    Here is the KnowledgeBase article for your reference:

    https://support.f5.com/csp/article/K7964

    Hope this helps,

    Sam

  • samstep_81205's avatar
    samstep_81205
    Icon for Nimbostratus rankNimbostratus
    Jan 23, 2017

    Joe,

    Timeout value is configured in "persist add uie" command in seconds.

    E.g. when you add a persistence record to the table you define how long it should live there.

    In your case for example for a 10-minute (600 second) timeout : 

    persist add uie [HTTP::cookie value "JSESSIONID"] 600

    Re: persistence not working - make sure you have OneConnect profile enabled on the virtual server. Without it the load-balancing decision is made upon the TCP connection (e.g. way BEFORE any cookies can be read).

    Here is the KnowledgeBase article for your reference:

    https://support.f5.com/csp/article/K7964

    Hope this helps,

    Sam

  • JosephB_242096's avatar
    JosephB_242096
    Icon for Nimbostratus rankNimbostratus
    Jun 06, 2017

    I noticed you had problems with Oracle Forms after upgrading to the F5 to version 12. HttpOnly was added as an enabled default in version 12 which I missed. Try making a cookie with that feature disabled, and things should work again. Browsers other than IE won't pass the flag, and Oracle has marked it as "Won't Fix".

     

    http://bugs.java.com/bugdatabase/view_bug.do?bug_id=8038997

     

    I also noticed the Secure attribute caused a similar problem when I tried to exit the Oracle Forms applet, so disabling that might help fix other issues.