For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Chris1269_13050's avatar
Chris1269_13050
Icon for Nimbostratus rankNimbostratus
Sep 29, 2015

Issue with replacing Set Cookie path within iRule

We have an issue where we need to replace the path in a within Set-Cookie field. We use an iRule for the RESPONSE and it works as expected for the first one, but for subsiquent ones, its not applying the replace.

HTTP::header replace Set-Cookie [string map -nocase {"/OLD" "/NEW"} [HTTP::header Set-Cookie]]

This works for the first one: Set-Cookie: ONE (cookie info); path=/NEW

Second one: Set-Cookie: TWO (cookie info); path=/OLD

Therefore i get two cookies on my machine. One for NEW and the other for OLD. What is meant to be happening is this is meant to be added to the original cookie... Any ideas? Thanks

7 Replies

  • You could try something like this to iterate through the cookies present.

    when HTTP_RESPONSE {
        set cookies [HTTP::cookie names]
        foreach cookie $cookies {
            set cookie_value [HTTP::cookie $cookie]
            set cookie_path [string map -nocase {"/OLD" "/NEW"} [HTTP::cookie path $cookie]]
            HTTP::cookie remove $cookie
            HTTP::cookie insert name $cookie value $cookie_value path $cookie_path
        }
    }
    
  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus

    I was also wondering whether you'd need a Oneconnect profile too on the virtual server... This will make the connection http request based, rather than TCP session based. Just a thought.

     

    N

     

  • Thanks for the responses. Unfortunatly, both suggestions didnt seem to work. Still only replacing the first one not the ones after. Even when looping through all cookies.

     

  • As far as I can see Brad suggestion should work, assuming the cookie you need to alter is inserted in the response by a device before the LTM receives it. Try adding in debug statement before you loop;-

     

    if {$debug} {log local0. "[HTTP:cookie names],[HTTP::values]

     

  • Still no luck. Is there a way to loop through all of the HTTP::header Set-Cookie within a response? Convert to a variable, alter the path=/, remove that specific HTTP::header Set-Cookie and insert the 'new one'. Iv attempted this using different methods but im having no luck.

     

    Similar to what i did in my original post but for all of them. Looping through the actual cookies as suggested is causing other issues. Thanks

     

  • So 'HTTP::header replace' only acts on the last instance of the specified header. So if, for instance you are trying to replace a header inserted by the server, but the LTM has inserted its own cookie (due to cookie persistence profile) on the same response, you'll actually over-write the F5 cookie.

     

    Why is cookie enumeration causing problems?