Forum Discussion
Nate_7016
Dec 01, 2017Historic F5 Account
Log http cookie before it's encrypted in the HTTP profile on response from the server
I had this question come up and thought it would be handy to have around. It's obviously a bit of a risk because your encrypted cookie is now logged to the Big-IP in plain text but here it is.
when SERVER_CONNECTED {
TCP::collect 100
}
when SERVER_DATA {
set indices [regexp -all -inline -indices {Set-Cookie: [^\r]+} [TCP::payload]]
set cookielist [list]
foreach idx $indices {
lappend cookielist [string range [TCP::payload] [lindex $idx 0] [lindex $idx 1]]
}
log local0. "$cookielist"
TCP::release
}
This logs each cookie before the http profile encrypts it. Output looks like this in /var/log/ltm:
Dec 1 11:00:52 v11-1 info tmm[18616]: Rule /Common/Header_test : {Set-Cookie: XMLGWID=Here:1is\x5Cthe0length;}
No RepliesBe the first to reply
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects