Internal parameters for HTTPOnly and Secure cookies

Hello,

 

 

I've been looking for a iRule to set those parameters for cookies leaving the BIGIP, but now ran into ASM 10.2 release notes claiming there are two new internal parameters excatly for this. I just don't know how to turn those on?

 

 

Thanks,

 

Sami

 

 

http://support.f5.com/kb/en-us/prod...0_2_0.html

 

 

Fixes in this release This release includes the following fixes.

 

....

 

 

Cookie internal parameters added (CR131850) There are two more internal parameters, not available in the Configuration utility.

 

 

• Cookie_secure_attr: Cookie secure special attribute. If you set this parameter’s value to 1, the system adds a secure attribute to each Application Security Manager cookie in the response. The system adds the secure attribute only when the traffic protocol is HTTPS. This prevents the network from sniffing the cookie. The parameter’s default value is 0 (false).

 

 

• Cookie_httponly_attr: Cookie HTTPOnly special attribute. If you set this parameter’s value to 1, the system adds the HTTPOnly attribute to each Application Security Manager cookie in the response. This instructs the browser to restrict JavaScript access to that cookie. This mitigates the risk of someone picking up that cookie using XSS. The parameter’s default value is 0 (false).