Forum Discussion
Erlend_123973
Nimbostratus
NimbostratusHow to securely present user supplied data in HTTP::respond NNN content
When i write iRules, I often use something like
HTTP::respond 403 content "Error: variable $somevar not in datagroup"
My concern here is,
$somevar is userdefined data - often a part of HTTP::pa...
Kevin_Stewart
Employee
EmployeeI'd perhaps suggest two things:
-
Set the HTTPOnly flag on all cookies. It's of course not a 100% solution, but it would prevent most script-based access to cookies.
-
As WLB suggests, simply URI::encode the output value:
HTTP::respond 403 content "Error: variable [URI::encode $somevar] not in datagroup"
