For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

SL's avatar
SL
Icon for Cirrus rankCirrus
Sep 17, 2015

httponly option without http profile

Hi All   Is it at all possible to enable the httponly option other than using cookie or ASM?   Reason for the question is that I am trying to enable ASM for IBM Endpoint Manager for Remote Cont...
application delivery
ASM Advanced WAF
deployment
LTM
security
TMSH
Brad_Parker_139's avatar
Brad_Parker_139
Icon for Nacreous rankNacreous
Oct 20, 2015

You can not use an HTTP profile without a ClientSSL profile for HTTPS traffic. Is your virtual server HTTP or HTTPS? If it is HTTPS and you need end-to-end SSL you will also need a ServerSSL profile to re-encrypt.

 

  • SL's avatar
    SL
    Icon for Cirrus rankCirrus
    Oct 23, 2015
    Hi Brad That is the way I understand it to work as well, was just asking if anyone was able to get it to work without the http profile. It is a https virtual server, the issue is application related in that it does not allow us to inspect the traffic, thus when I enable the http profile the application doesnt work via the F5.
  • Brad_Parker_139's avatar
    Brad_Parker_139
    Icon for Nacreous rankNacreous
    Oct 23, 2015
    Enabling the HTTP profile in and of itself will not affect the traffic in any way and is transparent to the application. Do you have SSL profiles enabled? They too should be transparent to the application. How does your application "not work"? There is no way to see or alter the payload of encrypted traffic, that's why HTTPS requires client ssl profiles if you want to see the content.