Forum Discussion
Generic Cookie Names
I have a need to correct cookie persistence on a set of legacy 10.2.x boxes by encrypting all the generic cookies using the default cookie persistence. I really don't want to use an iRule to fix this.
By default, F5 creates a cookie with the generic profile that has the pool name in the cookie name and the server IP in the payload. If I change the default HTTP profile or create a single HTTP profile for all VS's to use a generic name like "Cookie_Persist", will the individual pool information be contained within the cookie since its not appended to the name? What are the ramifications of doing this?
2 Replies
- Kevin_Stewart
Employee
A custom cookie persistence profile with a specific name will not include the pool name in the cookie name - only the encoded IP and port. The default cookie persistence profile has the added benefit of being usable across VIPs (with the same pool), so your custom cookie profile will simply use the pool that is configured in the VIP. Otherwise your custom cookie profile should be fine.
As for encrypting the cookie contents, you could simply enable cookie encryption in the HTTP profile and provide the name of the cookie(s) that you want to encrypt and a passphrase.
"If I change the default HTTP profile or create a single HTTP profile for all VS's to use a generic name like "Cookie_Persist", will the individual pool information be contained within the cookie since its not appended to the name? What are the ramifications of doing this?"
It sounds like Valentine may want to use one profile across multiple VIPs. If clients will be hitting multiple VIPs, where each VIP has a different pool, you're better off not changing the name of the cookie - as Kevin mentioned, you'll lose the pool name in the cookie name - and it's not included in the value. Ramifications would be you run the risk of a client coming in with the same cookie name present in the header for another VIP & breaking persistence.
You can actually use a custom profile with a custom cookie name across VIPs and maintain persistence as long as the pool makeup is the same - IP & Port - pool name shouldn't matter. I've done that in situations where I needed to maintain persistence across multiple load balancers - ie load balancers for load balancers but had to use a standard cookie name & no iRule logic.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com