For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mark_Wallis_833's avatar
Mark_Wallis_833
Icon for Nimbostratus rankNimbostratus
Apr 13, 2010

Cookies - HttpOnly, Secure and ASM

Hi,     I'm trying to use the iRule code below in our HTTP_RESPONSE event to ensure that the secure flag is enabled on all our outgoing Set-Cookie's.     foreach a_cookie [HTTP::coo...
application delivery
dev
devops
iRules
Pavel_Jurik_707's avatar
Pavel_Jurik_707
Icon for Nimbostratus rankNimbostratus
Sep 12, 2012
Hi Mark,

 

 

have you solved the issue regarding the 1st question?

 

We have the same problem that F5 parse a cookie with httponly parameter as 2 separate cookies - first is named JSESSIOND and second is HTTPONLY.

 

 

regarding 2nd questions - there is workaround in 10.2.0:

 

http://support.f5.com/kb/en-us/products/big-ip_asm/releasenotes/product/relnotes_asm_10_2_0.html

 

Cookie internal parameters added (CR131850)

 

 

thanks

 

pave