Encrypt-Decrypt all the cookies on the fly

Question

Our applications use a lot of cookies so I wanted to secure it via an Irule inspired by these i can find in this forum but nothing is working. When I use my Irule or another one, my website doesn't work at all.  
&nbsp;  
&nbsp; Thanks if someone can help me to understand what's wrong with the Irule: 
&nbsp;  
&nbsp; My idea was: 
&nbsp;  
&nbsp; - init a passphrase. 
&nbsp; - for each cookie, I encrypt it, remove the older one and I insert the encrypted one (server -&gt; client). 
&nbsp; - for each cookie, I decrypt it, remove the older one and I insert the decrypted one. (client -&gt; server) 
&nbsp;  
&nbsp; when RULE_INIT {    
&nbsp;   set ::cookie_passphrase "123AqwZsx" 
&nbsp; } 
&nbsp;  
&nbsp;  
&nbsp; when HTTP_RESPONSE { 
&nbsp;  
&nbsp;    set myValues [HTTP::cookie names] 
&nbsp;    foreach mycookies $myValues {  
&nbsp; log local0. "Cookie $mycookies : Value before encryption is [HTTP::cookie value $mycookies]: " 
&nbsp; set encrypted_value [HTTP::cookie encrypt $mycookies $::cookie_passphrase] 
&nbsp; log local0. "Encrypted value is $encrypted_value" 
&nbsp; HTTP::cookie remove $mycookies 
&nbsp; HTTP::cookie insert name $mycookies value $encrypted_value 
&nbsp; log local0. "Cookie $mycookies : Send value is [HTTP::cookie value $mycookies]: " 
&nbsp; } 
&nbsp; } 
&nbsp;  
&nbsp; when HTTP_REQUEST { 
&nbsp;    set myValues [HTTP::cookie names] 
&nbsp;    foreach mycookies $myValues {  
&nbsp; log local0. "Cookie $mycookies : Received value is [HTTP::cookie value $mycookies]: " 
&nbsp; set decrypted_value [HTTP::cookie decrypt $mycookies $::cookie_passphrase] 
&nbsp; HTTP::cookie remove $mycookies  
&nbsp; HTTP::cookie insert name $mycookies value $decrypted_value 
&nbsp; log local0. "Cookie $mycookies : Decrypted value send to backend is  [HTTP::cookie value $mycookies]: " 
&nbsp; } 
&nbsp; }

hoolio · Answer

Hi Adrien, 
&nbsp;  
&nbsp; Are there any errors in /var/log/ltm?  Can you post anonymized copies of the ltm logs?  Which LTM version are you running?   
&nbsp;  
&nbsp; Also, is there ever a case where the app expects that a client should be able to modify a cookie value? 
&nbsp;  
&nbsp; Aaron

adrien_legros_1 · Answer

Hello, first thanks for your interest with my problem. 
&nbsp;  
&nbsp; Here is an extract of the LTM log. It seems to work with the cookie cook1 and sometimes there is nothing in it... 
&nbsp; And I don't think the client should modify the cookie. If he should, I understand that I could not encrypt-decrypt it on the F5. 
&nbsp;  
&nbsp; Thu Oct 16 14:57:18 CEST 2008  tmm  tmm[944]     Rule secure_cookie_test HTTP_REQUEST: Cookie cook1 : Received value is GmTM4JrlKFPgC6p1af3uqAiAYbAFIk3l4X3Ff4/rQm7SUmTL7dzZ7rldPauDpZCk1STylq0gaPrVIKFOSlJImklEusM2eIVxZpJGxkGTD7KrCG7qjSlbRBLGZD/WY=:   
&nbsp; Thu Oct 16 14:57:18 CEST 2008  tmm  tmm[944]     Rule secure_cookie_test HTTP_REQUEST: Cookie cook1 : Decrypted value send to backend is 1e1bcc1010b6de32734c584317443b31.00.025c64fa80e0da7e279af9b0bd9212ca:   
&nbsp; Thu Oct 16 14:57:18 CEST 2008  tmm  tmm[944]     Rule secure_cookie_test HTTP_REQUEST: Cookie cook1_wat_2Enbb2Ebe_2F : Received value is QVNQLk5FVF9TZXNzaW9uSWQ_?4b284dd5eaf9f32ef409c86291a232d1:   
&nbsp; Thu Oct 16 14:57:18 CEST 2008  tmm  tmm[944]     Rule secure_cookie_test HTTP_REQUEST: Cookie cook1_wat_2Enbb2Ebe_2F : Decrypted value send to backend is :   
&nbsp; Thu Oct 16 14:57:18 CEST 2008  tmm  tmm[944]     Rule secure_cookie_test HTTP_REQUEST: Cookie ns_cookietest : Received value is true:   
&nbsp; Thu Oct 16 14:57:18 CEST 2008  tmm  tmm[944]  01220001  TCL error: Rule secure_cookie_test HTTP_REQUEST - Out of bounds line 1 invoked from within HTTP::cookie decrypt $mycookies $::cookie_passphrase foreach body line 3 invoked from within foreach mycookies $myValues { log local0. Cookie $mycookies : Received value is [HTTP::cookie value $mycookies]: set decrypted_value [HTTP::co...   
&nbsp; Thu Oct 16 14:57:33 CEST 2008  tmm  tmm[944]     Rule secure_cookie_test HTTP_REQUEST: Cookie nbbrpid : Received value is GmTM4JrlKFPgC6p1af3uqAiAYbAFIk3l4X3Ff4/rQm7SUmTL7dzZ7rldPauDpZCk1STylq0gaPrVIKFOSlJImklEusM2eIVxZpJGxkGTD7KrCG7qjSlbRBLGZD/WY=:   
&nbsp; Thu Oct 16 14:57:33 CEST 2008  tmm  tmm[944]     Rule secure_cookie_test HTTP_REQUEST: Cookie nbbrpid : Decrypted value send to backend is 1e1bcc1010b6de32734c584317443b31.00.025c64fa80e0da7e279af9b0bd9212ca:   
&nbsp; Thu Oct 16 14:57:33 CEST 2008  tmm  tmm[944]     Rule secure_cookie_test HTTP_REQUEST: Cookie nbbrpid_wat_2Enbb2Ebe_2F : Received value is QVNQLk5FVF9TZXNzaW9uSWQ_?4b284dd5eaf9f32ef409c86291a232d1:   
&nbsp; Thu Oct 16 14:57:33 CEST 2008  tmm  tmm[944]     Rule secure_cookie_test HTTP_REQUEST: Cookie nbbrpid_wat_2Enbb2Ebe_2F : Decrypted value send to backend is :   
&nbsp; Thu Oct 16 14:57:33 CEST 2008  tmm  tmm[944]     Rule secure_cookie_test HTTP_REQUEST: Cookie ns_cookietest : Received value is true:   
&nbsp; Thu Oct 16 14:57:33 CEST 2008  tmm  tmm[944]  01220001  TCL error: Rule secure_cookie_test HTTP_REQUEST - Out of bounds line 2 invoked from within HTTP::cookie decrypt $mycookies $::cookie_passphrase foreach body line 3 invoked from within foreach mycookies $myValues { log local0. Cookie $mycookies : Received value is [HTTP::cookie value $mycookies]: set decrypted_value [HTTP::co...   &nbsp;

adrien_legros_1 · Answer

I understood that the encryption did not work on the boolean value to test if the cookies are sen. So, I've modified my code: 
&nbsp;  
&nbsp; One cookie is well encrypted but the others are sent in clear...that's what I dont understand... No more errors in the LTM logs.. 
&nbsp; when RULE_INIT {    
&nbsp;   set ::cookie_passphrase "123AqwZsx" 
&nbsp; } 
&nbsp;  
&nbsp; when HTTP_RESPONSE { 
&nbsp;  
&nbsp; log local0. "reponse1" 
&nbsp;    set myValues [HTTP::cookie names] 
&nbsp;    foreach mycookies $myValues {  
&nbsp; if {$mycookies ne "ns_cookietest"}{ 
&nbsp; log local0. "Cookie $mycookies : Value before encryption is [HTTP::cookie value $mycookies]: " 
&nbsp; set encrypted_value [HTTP::cookie encrypt $mycookies $::cookie_passphrase] 
&nbsp; log local0. "Encrypted value is $encrypted_value" 
&nbsp; HTTP::cookie remove $mycookies 
&nbsp; HTTP::cookie insert name $mycookies value $encrypted_value 
&nbsp; log local0. "Cookie $mycookies : Send value is [HTTP::cookie value $mycookies]: " 
&nbsp; } 
&nbsp; } 
&nbsp; } 
&nbsp;  
&nbsp; when HTTP_REQUEST { 
&nbsp;    set myValues [HTTP::cookie names] 
&nbsp;    foreach mycookies $myValues {  
&nbsp; if {$mycookies ne "ns_cookietest"}{ 
&nbsp; log local0. "Cookie $mycookies : Received value is [HTTP::cookie value $mycookies]: " 
&nbsp; set decrypted_value [HTTP::cookie decrypt $mycookies $::cookie_passphrase] 
&nbsp; HTTP::cookie remove $mycookies  
&nbsp; HTTP::cookie insert name $mycookies value $decrypted_value 
&nbsp; log local0. "Cookie $mycookies : Decrypted value send to backend is  [HTTP::cookie value $mycookies]: " 
&nbsp; } 
&nbsp; } 
&nbsp; }

hoolio · Answer

Can you post the logs from a full request/response/request loop where the client makes a new request with no cookies, the app sets one or more and then the client makes a second request with the cookie(s)? 
&nbsp;  
&nbsp; Can you also check the application log to see what cookies LTM is actually including in the proxied request? 
&nbsp;  
&nbsp; Thanks, 
&nbsp; Aaron

adrien_legros_1 · Answer

First request : 
&nbsp;  
&nbsp; GET / HTTP/1.1 
&nbsp; Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* 
&nbsp; Accept-Language: fr-be,nl-be;q=0.5 
&nbsp; UA-CPU: x86 
&nbsp; Accept-Encoding: gzip, deflate 
&nbsp; User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; custom; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1; InfoPath.2; custom; custom) 
&nbsp; Host: www-test.be 
&nbsp; Connection: Keep-Alive 
&nbsp; Cookie: cook1_wlf_%2X%2Ebe_%2F=d2NvX3dlYnNpdGU_?0190f8a8f762916c71a08f02dbd1eedf; __utma=137988534.2036467364596942600.1224164176.1224164176.1224164176.1; __utmb=137988534.1.10.1224164176; __utmz=137988534.1224164176.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) 
&nbsp;  
&nbsp; response: 
&nbsp; .... 
&nbsp; Set-Cookie: cook1=1e1bcc1010b6de32734c584317443b31.00.b4c9d0e1eeb6a643fa3704930bcce80d; domain=.X.be; path=/ 
&nbsp; .... 
&nbsp;  
&nbsp; Second request with the cookies on my client: 
&nbsp;  
&nbsp; .... 
&nbsp; Cookie: nbbrpid_wlf_%2X%2Ebe_%2F=d2NvX3dlYnNpdGU_?0190f8a8f762916c71a08f02dbd1eedf; cook1=1e1bcc1010b6de32734c584317443b31.00.a25aec8bff1a72dd30e197dd08f85656; __utma=137988534.2036467364596942600.1224164176.1224164176.1224164297.2; __utmb=137988534.1.10.1224164297; __utmz=137988534.1224164176.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); ns_cookietest=true; ns_session=true; __utmc=137988534 
&nbsp;  
&nbsp; Response: 
&nbsp; Set-Cookie: cook1_wat_%2X%2Ebe_%2F=QVNQLk5FVF9TZXNzaW9uSWQ_?f44df5b292c91c84cf313fd96395178f; domain=.X.be; path=/ 
&nbsp;  
&nbsp;  
&nbsp; Cook1 is well encrypted - decrypted but nothing happens with the others. &nbsp;

Forum Discussion

Encrypt-Decrypt all the cookies on the fly

9 Replies

F5 Container Ingress Services (CIS) and using k8s traffic policies to send traffic directly to pods

F5 Architecture Track Sessions - AppWorld 2026

Recent Discussions

Same LTM Monitor applied to different Pools with Common Nodes

irule execution error

F5 AWAF/ASM learning only from Trusted traffic?

OWA File Upload URIs for WAF Bypass

Curl 7.10.5 < 8.12.0 Integer Overflow (CVE-2025-0725)

Related Content

Decrypt, Encrypt, Decrypt, Encrypt, Encrypt....

encrypted cookie generation and decryption

Encrypting Cookies

Cookie-based DDoS protection

2. SYN Cookie: Operation

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS