How to set the scope of the cookie at the context root level

Hi Abdul,

Can you explain your context please! it will help us to advise you more better.

Regards

Hi Youssef,

There are three applications that are calling internally one to another and the persistance is set to Cookie for all three. When the Browser session starts for one application, a cookie gets generated for it and when the request reaches the other, the cookie gets overwritten by the new Application generated cookie. When the request comes back to the first initiated application, the Application does not understand the cookie since it was not generated by it. So the app team requested if the scope of the cookie could be set to the context root so that there is no overwritten of the cookies.

It depends on the domain of the cookies and the applications. Cookies have both a domain and a path attribute and you can set these in the F5 to enable them to be used separately.

For instance, imagine if you have app1.example.com, app2.example.com and app3.example.com. If app1 sets a cookie called ExampleCookie with a domain of *.example.com then app2.example.com can access and change that cookie. To keep these separate you want to have the domain as app1.example.com only.

The same deal with the path - there could be apps in /app1, /app2 and /app3 but the cookie is set with a path of /. In which case all apps can access and change the cookie.

You can use the HTTP::cookie iRule commands to log the actual domains and paths in use to determine the issue and then create an iRule to set them appropriately. You may also want to set the secure and httponly flags if they are not set.

Did you use apm? for secure app access or just LTM?

LTM