Forum Discussion
KellyS_50017
Nimbostratus
Nov 11, 2009http_to_https http profile rule question
Hopefully a super-easy question about the built-in http class profile rule, http_to_https. A client of ours is saying HP's WebInspect is dinging us with a security flaw when it tries to get into areas...
hoolio
Cirrostratus
Nov 11, 2009Hi Kelly
If you're only redirecting the client from HTTP to HTTPS using a class or iRule, the request is never going to get to the web app, so no cookie could be set insecurely there. But if a client received a cookie from the app via HTTPS or from any other app on the same domain, they would potentially include the cookies in the request to the HTTP VIP.
One way to handle this issue is by setting the secure flag on all sensitive cookies when they're sent to the client. This assumes that you never need to get the cookie(s) for HTTP requests. This is one reason to only use HTTPS for web apps which pass sensitive data.
http://www.w3.org/Protocols/rfc2109/rfc2109
Secure
Optional. The Secure attribute (with no value) directs the user
agent to use only (unspecified) secure means to contact the origin
server whenever it sends back this cookie.
The user agent (possibly under the user's control) may determine
what level of security it considers appropriate for "secure"
cookies. The Secure attribute should be considered security
advice from the server to the user agent, indicating that it is in
the session's interest to protect the cookie contents.
Aaron
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects