Forum Discussion
Siva_107534
Nimbostratus
Dec 28, 2009How to encrypt the cookies generated by LTM?
Hi All,
How to encrypt the cookie information generated by LTM in the browser, becoz
by default cookies in the browser displays the Internal Pool IP of web servers
accessed through LTM . This is highly insecure..
I understand i can be encrypted thru irule, any one can guide exact iRule to make the browser cookies in the encrypted format
Any pls help....
- The_Bhattman
Nimbostratus
Hi Siva, - hoolio
Cirrostratus
In 9.4 and higher, you could also use the HTTP profile option for encrypting the cookie: - Chris_Olson
Nimbostratus
Help. We are using 9.3.1 and got hit on a vulnerability scan for unencrypted cookies. I used the link http://devcentral.f5.com/wiki/defau...okies.html - hoolio
Cirrostratus
Hi Chris, - Chris_Olson
Nimbostratus
Here is the debug info. As before, I had to log in and out of the app multiple times before all aspects of the webapp responded properly without kicking me back to the login page. - Chris_Olson
Nimbostratus
Forgive me if I am not posting properly. Hope this is OK
- hoolio
Cirrostratus
That's a cool site. Here's the iRule code:TCL error: Rule Enterprise_F5_Fix_with_E35-THD_cookie_encrypt HTTP_REQUEST - cant read cookie: no such variable while executing HTTP::cookie value $cookie when CLIENT_ACCEPTED { Define an AES encryption key. A 128 bit (or larger) key is recommended. You can use a key generator, or create your own using only HEX characters. set aes_key "63544a5e7178677b45366b4140" Name of the cookie to encrypt/decrypt set cookie "app_cookie" Log debug messages to /var/log/ltm? 1=yes, 0=no. set cookie_encryption_debug 0 } when HTTP_REQUEST { If the error cookie exists with any value, for any requested object, try to decrypt it if {[string length [HTTP::cookie value $cookie]]}{ if {$cookie_encryption_debug}{log local0. \ "Original error cookie value: [HTTP::cookie value $cookie]"} URI decode the value (catching any errors that occur when trying to decode the cookie value and save the output to cookie_uri_decoded) if {not ([catch {URI::decode [HTTP::cookie value $cookie]} cookie_uri_decoded])}{ Log that the cookie was URI decoded if {$cookie_encryption_debug}{log local0. "\$cookie_uri_decoded was set successfully"} Decrypt the value if {not ([catch {AES::decrypt $aes_key $cookie_uri_decoded} cookie_decrypted])}{ Log the decrypted cookie value if {$cookie_encryption_debug}{log local0. "\$cookie_decrypted: $cookie_decrypted"} } else { URI decoded value couldn't be decrypted. } } else { Cookie value couldn't be URI decoded } } else { Cookie wasn't present in the request } if {[HTTP::uri] ends_with ".asmx?WSDL"}{ set rewrite 1 if { [HTTP::version] eq "1.1" } { HTTP::version "1.0" } } else { set rewrite 0 } switch [getfield [string tolower [HTTP::uri]] "/" 2] { appe21test {pool test.app_EE_20 } appe21 { pool www.company.com_e20 } appe30 { pool www.company.com_e30 } appe30test { pool www.company.com_e30test } se08q4 { pool www.company.com_08q4 } } } when HTTP_RESPONSE { Check if response contains an error cookie with a value if {[string length [HTTP::cookie value $cookie]] > 0}{ Log the original error cookie value from the app if {$cookie_encryption_debug}{log local0. \ "Response from app contained our cookie: [HTTP::cookie value $cookie]"} Encrypt the cookie value so the client can't change the value HTTP::cookie value $cookie [URI::encode [AES::encrypt $aes_key [HTTP::cookie value $cookie]]] Log the encoded and encrypted error cookie value if {$cookie_encryption_debug}{log local0. \ "Encrypted error cookie to: [URI::encode [AES::encrypt $aes_key [HTTP::cookie value $cookie]]]"} } if {$rewrite == 1}{ collect payload for URI replacement if {[HTTP::header exists Content-Length]}{ set clength [HTTP::header Content-Length] } else { set clength 4294967295 } if { !($clength == 0) } { HTTP::collect $clength } } } when HTTP_RESPONSE_DATA { set payload [HTTP::payload] regsub -all {(
Aaron
- hoolio
Cirrostratus
So the encryption/decryption looks to be working in your logs. Did you get the runtime TCL error "cant read cookie: no such variable while executing HTTP::cookie value $cookie" on every request which wasn't persisted correctly? Or did that just occur when you first added the iRule? - hoolio
Cirrostratus
A couple of other points I forgot: - Chris_Olson
Nimbostratus
Aaron,
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects