Forum Discussion

BOUABRE_343008's avatar
BOUABRE_343008
Icon for Nimbostratus rankNimbostratus
Dec 05, 2017

HTTPOnly "attribute and secure "attribute

Hello everyone

 

The report of my scan shows us the following errors: - "The cookie does not contain the" HTTPOnly "attribute." - "The cookie does not contain the" secure "attribute." I added the following irula that works very well: when HTTP_RESPONSE { foreach mycookie [HTTP :: cookie names] { HTTP :: cookie secure $ mycookie enable } }

 

But when I try to write the script secure cookie + httponly: when HTTP_RESPONSE { foreach mycookie [HTTP :: cookie names] { HTTP :: cookie secure $ mycookie enable HTTP :: httponly cookie $ mycookie enable } }

 

I have an error, can you help me?

 

application delivery
ASM Advanced WAF
BIG-IP
security
  • Lee_Sutcliffe's avatar
    Lee_Sutcliffe
    Icon for Nacreous rankNacreous
    Dec 05, 2017

    Hi, looks to be a typo, try this:

    HTTP_RESPONSE { 
    foreach mycookie [HTTP::cookie names] { 
        HTTP::cookie secure $mycookie enable 
        HTTP::cookie httponly $mycookie enable 
        } 
}
  • Srini_87152's avatar
    Srini_87152
    Icon for Cirrostratus rankCirrostratus
    Dec 28, 2017

    if you running 12.x version,default you have option enable these on cookie level.

     

    Thx Srini