Cookies with Duplicate Names, but different values not getting Secure and HttpOnly attributes set
We had an ASV scan come back with one of our applications not setting the Secure and HttpOnly attributes. When they set at the application layer it seems to break their SSO functionality. We are digging into that, but in the meantime, we are using the following iRule to add Secure and HttpOnly attributes. It works; however I noticed that the application has two cookies they are sending with identical names, but different values. For one reason or another, the first cookie with the same name gets the attributes and the second is ignored. We are exploring if the application team needs these and if not we can remove them; however, until then I'm trying to see if anyone else has had this issue or thoughts on a solution.
https://support.f5.com/csp/article/K84048752
when HTTP_RESPONSE {
foreach mycookie [HTTP::cookie names] {
set ck_value [HTTP::cookie value $mycookie]
set ck_path [HTTP::cookie path $mycookie]
HTTP::cookie remove $mycookie
HTTP::cookie insert name $mycookie value $ck_value path $ck_path version 1
HTTP::cookie secure $mycookie enable
HTTP::cookie httponly $mycookie enable
}
}
/jeff