Forum Discussion

DJDX21_252164's avatar
DJDX21_252164
Icon for Cirrus rankCirrus
Mar 17, 2016

iRule to rewrite cookie domain to toplevel domain

I have to domains, 1. xyz.abc.com 2. xyz.abbc.com Now when I am trying to change the domain of the cookie at the toplevel the below iRule isn't working.   when HTTP_RESPONSE { set a ".abc.com" set...
BIG-IP
cookies
devops
iRules
security
  • DJDX21_252164's avatar
    DJDX21_252164
    Mar 18, 2016

    Finally I was able to set the cookie domain to toplevel by using the following iRule. Cookies are set to toplevel domain now by using HTTP::host and comparing directly with the domain values I have. What do you think about the following iRule? Any flaws?

    when HTTP_REQUEST {
    log local0. "Cookie names in received request: [HTTP::cookie names] from IP: [IP::local_addr]"
   set httphost [HTTP::host]
}

when HTTP_RESPONSE { 
    foreach mycookie [HTTP::cookie names] { 
     log local0. "Host : $httphost"
        if { $httphost ends_with ".abc.com" } { 
            HTTP::cookie domain $mycookie ".abc.com"
        } elseif { $httphost ends_with ".abbc.com" } { 
            HTTP::cookie domain $mycookie ".abbc.com"
        } else {
          log local0. "Not a single cookie domain matched :"
        }
    } 
}
Sylvain_85827's avatar
Sylvain_85827
Icon for Cirrus rankCirrus
Mar 17, 2016

When you do not use the if statements, you insert/replace domain cookie because you do not question about $cookieDomain value. That's why it's working.

 

The if statement are not working just because there is nothing into $cookieDomain variable. So the they always return "fasle" and you end up into the final else (the one logging Not a single cookie domain matched :/)

 

It would help if you could post HTTP headers into the response (name and value, eventually values anonymized) since it seems you want to rewrite domain cookie in responses. You can use developer tool in Chrome or Firefox to do that (F12 and network console), or a tcpdump or any other solution you like.

 

I have the feeling you're not using the correct cookie statement (ie. HTTP::cookie domain in your iRule) but I can be wrong. Having clear listing of HTTP headers in responses would be definitively helpful.