For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

JasonB_124480's avatar
JasonB_124480
Icon for Nimbostratus rankNimbostratus
Jun 24, 2015

iRule : BIGipServer cookies HttpOnly generating Improper version errors

Hi,   The following iRule is working fine to encrypt and set secure flag. Currently running on 11.2.1 HF13.   When adding HttpOnly flag we are receiving the following errors:   - Improper versi...
sfuerst_116779's avatar
sfuerst_116779
Historic F5 Account
Jun 24, 2015

The HTTP::version command changes the value of the "version" cookie attribute string. It doesn't actually change the type of the cookie from Netscape-style to RFC 2109 or RFC 2965 style cookies. So if the cookie doesn't support the "HttpOnly" attribute, attempting to set it will not work.

 

What's worse, is that RFC 6265 style cookies will be miss-detected as Netscape style cookies. Until this is fixed, you are unfortunately better off using HTTP::header commands to manually edit HTTP cookies.

 

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Jun 29, 2015
    you know if there is a bug ID for this?