For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Bill_Guo_210985's avatar
Bill_Guo_210985
Icon for Nimbostratus rankNimbostratus
Sep 14, 2015

How to make the presistence cookie inserted via irule expire at the end of session?

Here is the example of my irule. when HTTP_REQUEST { if { ([HTTP::uri] starts_with "/Risk") } { pool pool-a persist cookie insert "RA" } }

 

The version of the OS is BIG-IP 11.5.2 Build 0.0.141 Final.

 

I have tried the workaround in https://support.f5.com/kb/en-us/solutions/public/11000/600/sol11679.html. (modify ltm persistence cookie RA timeout 0)

 

Here is the related output from bigip.conf. It has "timeout 0".

ltm persistence cookie /Common/RA { always-send disabled app-service none cookie-encryption disabled cookie-name RA defaults-from /Common/cookie expiration 0 method insert override-connection-limit disabled

 

timeout 0

But the test still shows "EXPIRES 9/13/2015 7:49:29 PM". Does any body know how to resolve this issue? Thanks in advance.

 

2 Replies

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Sep 14, 2015

    Hi,

    there is no need to create a persistence profile RA.

    when applying command 

    persist cookie inter "RA"
    , the cookie properties are imported from VS assigned cookie persistence profile and name is replaced by RA.

    If the cookie persistence profile is defined with expiration date, the cookie will not expire at the end of session.

    you can change behavior of default profile with command 

    persist cookie inter "RA" 0

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Sep 15, 2015

    Hi,

    the persistence cookie profile does not define domain cookie. the cookie is sent without domain value and will be store in browser as a cookie for the requested hostname.

    the 

    persist cookie inter "RA" 0
    does not use the profile RA.

    that's why the virtual server have to be configured with cookie persistence before applying the irule on it.