Forum Discussion

Nate_7016's avatar
Nate_7016
Historic F5 Account
Dec 01, 2017

Log http cookie before it's encrypted in the HTTP profile on response from the server

I had this question come up and thought it would be handy to have around. It's obviously a bit of a risk because your encrypted cookie is now logged to the Big-IP in plain text but here it is.

when SERVER_CONNECTED {
 TCP::collect 100
}
when SERVER_DATA {
    set indices [regexp -all -inline -indices {Set-Cookie: [^\r]+} [TCP::payload]]
    set cookielist [list]
    foreach idx $indices {
        lappend cookielist [string range [TCP::payload] [lindex $idx 0] [lindex $idx 1]]    
    }
    log local0. "$cookielist"
    TCP::release
}

This logs each cookie before the http profile encrypts it. Output looks like this in /var/log/ltm:

Dec 1 11:00:52 v11-1 info tmm[18616]: Rule /Common/Header_test : {Set-Cookie: XMLGWID=Here:1is\x5Cthe0length;}

No RepliesBe the first to reply