Forum Discussion

Cirrus

Sep 29, 2022

Cookies, jsessionid and encryption

Hi All, Im relatively new to this. Our company had a third party do a pentest on our External apps in a DMZ. We had one call out for cookie information disclosure, so we turned on cookie encryption...

application delivery

security

PSilva

Ret. Employee

Sep 29, 2022

Maybe add the solution if others are experiencing the same?

Brian_Achenbaugh
Cirrus
Sep 30, 2022
So based on the info in this article:
https://community.f5.com/t5/technical-forum/how-can-i-insert-pool-member-ip-into-cookie-when-using-universal/m-p/265343
The person wanted to actually insert load balancing info into the universal persistence cookie as it wasnt there, so that sort of cleared my concern that it would be exposed like in a normal load balancing cookie. Im hoping my assumption was correct.

Forum Discussion

Cookies, jsessionid and encryption

Recent Discussions

FQDN resolve in non default domain name.

APM - Capture Login sharepoint

APM : is VMware Workspace One supported as an Endpoint Management System?

K000136009 mount: /usr is busy

Inquiry About DGME Portal Access Issues

Related Content

Decrypt, Encrypt, Decrypt, Encrypt, Encrypt....

Let's Encrypt

Encrypting Cookies

Cookie Encryption

Weblogic JSessionID Persistence