http_to_https http profile rule question

Okay, that's making a it more sense. WI is reporting that the client is receiving cookies from LTM/the app that do not have the secure flag set. Because there is an HTTP VIP defined that accepts TCP connections (regardless of what it does in terms of HTTP responses), if the client did make a request to the HTTP VIP, it would include the cookies which are not marked as secure by LTM/the app.

Now, if nothing references the HTTP VIP, a client should never make a request to the HTTP VIP after they've received a cookie from the app and this shouldn't be a problem. But it would still be a simple change to the app or with an LTM iRule to add the secure flag to the cookies to explicitly tell clients not to send the cookie in requests made via HTTP. Here is an example iRule:

 
 when HTTP_RESPONSE { 
  
     Insert a test cookie (remove this when done testing) 
    HTTP::cookie insert name test_cookie value test_value path / 
  
     Set the secure flag on the test cookie (remove this when done testing) 
    HTTP::cookie secure test_cookie enable 
  
     Loop through each cookie in the response by name 
    foreach a_cookie [HTTP::cookie names] { 
  
       log local0. "$a_cookie=[HTTP::cookie value $a_cookie], secure: [HTTP::cookie secure $a_cookie]" 
  
        Set the secure flag on the cookie. 
         The flag only seems to be set if it's not there already, so no need to check the original state first 
       HTTP::cookie secure $a_cookie enable  
    } 
 } 
 

Log output:

: BIGipServerGoogle_http_pool=1680702794.20480.0000, secure: disable

: test_cookie=test_value, secure: enable

Response headers received by the client:

Set-Cookie: BIGipServergoogle_http_pool=1680702794.20480.0000;secure; path=/

Set-Cookie: test_cookie=test_value;secure;path=/;

Aaron