Forum Discussion
NimbostratusDisable http for Cookie persistance setup
We have a requirement from an IVR vendor to enable Cookie without HTTP. I tried to configure Cookie w/o http and got an error that Cookie persistence requires an HTTP or FastHTTP profile to be associated with the virtual server. Is there a way to fulfill this setup below?
HTTP Cookie If the HTTP Cookie persistence type is selected, ensure that the cookie type is not HTTPOnly (this may be the default type in some NLB models). HTTPOnly cookies are not available for Java Applets, which also require session stickiness. If the HTTP Cookie persistence type is selected, ensure that you determine a unique cookie name for each service.
Aaron_BookerEmployee
If you are going to use cookie persistence, for this application running through BIG-IP, it sounds like you need to disable the HTTPOnly Attribute in the cookie persistence profile. Without the HttpOnly flag a client side script can access the cookie. I should note that the HttpOnly flag protects against XSS attacks. Here is more information:
K83419154: Overview of cookie persistence