Forum Discussion

Approxee's avatar
Approxee
Icon for Nimbostratus rankNimbostratus
Sep 29, 2017

Cookie sets domain the same as the requesting Host Header

I have a cookie set with the domain name the same as the requested Host header and I have another cookie set where does not specify the domain. So both cookies end up saved for the same domain location, one because it is default and one because it is specified.

 

The problem is the ASM see's two cookie locations and set two TS cookies one for the default domain location and one for the specified domain location, even though they are the same domain

 

Is there are reason why the domain in the cookie would bet set to match the requesting host header - I cant think of one

 

Any information/responses would be very helpful

 

Graham

 

ASM Advanced WAF
cookies
security
  • Jad_Tabbara__J1's avatar
    Jad_Tabbara__J1
    Icon for Cirrostratus rankCirrostratus
    Sep 29, 2017

    Hi,

     

    so if I understand you have :

     

    • cookie1 domain=domain.com
    • cookie2 domain=host.domain.com
    • TSxxxx1 //set to cookie1
    • TSxxxx2 // set to cookie2

    Correct ?

     

    By default, if no "domain" is set the cookie is played by the client only for the specific "host".

     

    When setting the "domain" attribute it the cookie is played to all subdomains.

     

    So normally, depending on the need, only one cookie should be sufficient...

     

    Did you asked the "application team" why this is used like that ?

     

    Regards

     

  • Chris_Grant's avatar
    Chris_Grant
    Icon for Employee rankEmployee
    Oct 28, 2017

    You might want to review https://support.f5.com/csp/article/K6850 Overview of BIG-IP ASM cookies. The ASM always sets two TS cookies. One is a frame cookie.

     

    The main ASM cookie:

     

    • Validates domain cookies - the Main ASM cookie verifies that the domain cookies that are sent from the web server to the client are not altered. The BIG-IP ASM system parses HTTP responses from the web server for the Set-Cookie header. If the Set-Cookie header is present, the BIG-IP ASM system will perform a hash on the cookie, and insert the hash value into the Main ASM cookie.

       

    • Detects session expiration - BIG-IP ASM uses the Main ASM cookie to track user sessions for session expiration.

       

    • Validates the integrity of the ASM Frame cookies - the Main ASM cookie verifies the integrity of the ASM Frame cookies to ensure they are not altered.

       

    The Frame cookie:

     

    • Stores the referrer object
    • Tracks whether the referrer object is allowed to change the cookie

    The ASM Flow Frame cookie also handles the following dynamic data extractions:

     

    • Dynamic parameters names and values
    • Dynamic session extractions
    • Dynamic flow extractions
    • Dynamic parameter names extractions