For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

SL's avatar
SL
Icon for Cirrus rankCirrus
Sep 17, 2015

httponly option without http profile

Hi All   Is it at all possible to enable the httponly option other than using cookie or ASM?   Reason for the question is that I am trying to enable ASM for IBM Endpoint Manager for Remote Cont...
application delivery
ASM Advanced WAF
deployment
LTM
security
TMSH
Brad_Parker's avatar
Brad_Parker
Icon for Cirrus rankCirrus
Oct 20, 2015

You can not use an HTTP profile without a ClientSSL profile for HTTPS traffic. Is your virtual server HTTP or HTTPS? If it is HTTPS and you need end-to-end SSL you will also need a ServerSSL profile to re-encrypt.

 

Brad_Parker's avatar
Brad_Parker
Icon for Cirrus rankCirrus
Oct 23, 2015
Enabling the HTTP profile in and of itself will not affect the traffic in any way and is transparent to the application. Do you have SSL profiles enabled? They too should be transparent to the application. How does your application "not work"? There is no way to see or alter the payload of encrypted traffic, that's why HTTPS requires client ssl profiles if you want to see the content.