Forum Discussion

Cirrus

Sep 29, 2022

Cookies, jsessionid and encryption

Hi All, Im relatively new to this. Our company had a third party do a pentest on our External apps in a DMZ. We had one call out for cookie information disclosure, so we turned on cookie encryption...

application delivery

security

PSilva

Ret. Employee

Maybe add the solution if others are experiencing the same?

Brian_Achenbaugh

Cirrus

Sep 30, 2022

So based on the info in this article:

https://community.f5.com/t5/technical-forum/how-can-i-insert-pool-member-ip-into-cookie-when-using-universal/m-p/265343

The person wanted to actually insert load balancing info into the universal persistence cookie as it wasnt there, so that sort of cleared my concern that it would be exposed like in a normal load balancing cookie. Im hoping my assumption was correct.

Forum Discussion

Cookies, jsessionid and encryption

Recent Discussions

Unable to create F5 in AWS via CFT - no internet access

Creating iRule for Persistence Profile

Office hours for BIG-IP Next...

Different SNAT for each member in the pool

Logging Server-IP with OneConnect

Related Content

Decrypt, Encrypt, Decrypt, Encrypt, Encrypt....

Let's Encrypt

Encrypting Cookies

Cookie Encryption

Automate Let's Encrypt Certificates on BIG-IP