Forum Discussion
hooleylist
Jun 15, 2009Cirrostratus
Hi jsmccombs,
Can you post the actual full rule you were testing and the version you were testing on? I tried the following on 9.3.1, 9.4.7, 10.0.0 and didn't see the issue you're describing:
log local0. "path: [HTTP::path]"
log local0. "\[HTTP::header value Cookie\]: [HTTP::header value Cookie]"
log local0. "\[HTTP::cookie exists JSESSIONID\]: [HTTP::cookie exists JSESSIONID]"
log local0. "\[string length \[HTTP::cookie JSESSIONID\]\]: [string length [HTTP::cookie JSESSIONID]]"
}
: path: /no_JSESSIONID_cookie
: [HTTP::header value Cookie]:
: [HTTP::cookie exists JSESSIONID]: 0
: [string length [HTTP::cookie JSESSIONID]]: 0
: path: /JSESSIONID_cookie_without_a_value
: [HTTP::header value Cookie]: JSESSIONID=
: [HTTP::cookie exists JSESSIONID]: 0
: [string length [HTTP::cookie JSESSIONID]]: 0
: path: /JSESSIONID_cookie_with_a_value
: [HTTP::header value Cookie]: JSESSIONID=test
: [HTTP::cookie exists JSESSIONID]: 1
: [string length [HTTP::cookie JSESSIONID]]: 4
It looks like in 10.0.0, the bug where [HTTP::cookie exists "cookie_name"] returns zero with a cookie with no value (JSESSIONID=) was fixed.
Aaron