cookie persistence sendfor: http only

Just to clarify, the cookie insert persistence cookie contains an encoding of the pool member IP:port as described in SOL6917:

 

 

sol6917: Overview of BIG-IP persistence cookie encoding

 

https://support.f5.com/kb/en-us/solutions/public/6000/900/sol6917.html

 

 

So it does contain what could be considered sensitive data as it exposes the server IP addresses and ports from the pool. If that's a concern for you, you can encrypt the cookie value using a custom HTTP profile:

 

 

sol7784: Overview of cookie encryption

 

http://support.f5.com/kb/en-us/solutions/public/7000/700/sol7784.html

 

 

That said, the fact that the persistence cookie is accessible from clientside scripts is somewhat irrelevant as it's not specific to the client's session--an attacker could get all of the possible cookie values just by making requests to the virtual server.

 

 

Aaron