Forum Discussion
LTM 11.1.0 Cookie httponly flag TCL errors
All,
Have deploy cookie httponly flag for PCI compliance. New irule takes down the website when applied. I am running http classes and i had to do httpclass disable for other irules. Has anyone run into this issue?
Thanks,
Bryce
when HTTP_RESPONSE {
Check if the response contains the persistence cookie
if {[HTTP::cookie BIGipServerWeblogic_Pool_STAGING] ne ""}{
Set the httponly flag on the persistence cookie if it is in the response
HTTP::cookie httponly BIGipServerWeblogic_Pool_STAGING enable
}
}
TCL Errors
Jun 19 18:07:14 tmm2 err tmm2[8165]: 01220001:3: TCL error: /Common/BBB_Staging_Cookie_Flag - Improper version (line 7) invoked from within "HTTP::cookie httponly BIGipServerWeblogic_Pool_STAGING enable"
Jun 19 18:07:14 tmm err tmm[8163]: 01220001:3: TCL error: /Common/BBB_Staging_Cookie_Flag - Improper version (line 1) invoked from within "HTTP::cookie httponly BIGipServerWeblogic_Pool_STAGING enable"
Jun 19 18:07:17 tmm2 err tmm2[8165]: 01220001:3: TCL error: /Common/BBB_Staging_Cookie_Flag - Improper version (line 5) invoked from within "HTTP::cookie httponly BIGipServerWeblogic_Pool_STAGING enable"
Jun 19 18:07:29 tmm3 err tmm3[8166]: 01220001:3: TCL error: /Common/BBB_Staging_Cookie_Flag - Improper version (line 7) invoked from within "HTTP::cookie httponly BIGipServerWeblogic_Pool_STAGING enable"
5 Replies
- hoolio
Cirrostratus
Hey Bryce,
Sorry for the slow reply on this. I got sidetracked. Because HttpOnly can only be set for cookies with version 1 or 2 and the default version is 0, this is probably the cause of the problem. Can you set the version to 1 first:Set HttpOnly on all LTM and app generated cookies when HTTP_RESPONSE { set cookieNames [HTTP::cookie names] foreach aCookie $cookieNames { HTTP::cookie version $aCookie 1 HTTP::cookie httponly $aCookie enable } } Or just for one statically defined cookie: when HTTP_RESPONSE { HTTP::cookie version myCookie 1 HTTP::cookie httponly myCookie enable }
Aaron - nitass
Employee
i got illegal argument error on HTTP::cookie version.Jun 21 14:27:01 ve11a err tmm1[10969]: 01220001:3: TCL error: /Common/myrule - Illegal argument (line 1) invoked from within "HTTP::cookie version BIGipServerfoo 1"
so, i remove cookie and add it back later.
e.g.[root@ve11a:Active:Changes Pending] config tmsh list ltm virtual bar ltm virtual bar { destination 172.28.20.16:80 ip-protocol tcp mask 255.255.255.255 persist { cookie { default yes } } pool foo profiles { http { } tcp { } } rules { myrule } source 0.0.0.0/0 source-address-translation { type automap } vlans-disabled } [root@ve11a:Active:Changes Pending] config tmsh list ltm rule myrule ltm rule myrule { when HTTP_RESPONSE { if { [HTTP::cookie BIGipServerfoo] ne "" } { set ck_value [HTTP::cookie value BIGipServerfoo] set ck_path [HTTP::cookie path BIGipServerfoo] HTTP::cookie remove BIGipServerfoo HTTP::cookie insert name BIGipServerfoo value $ck_value path $ck_path version 1 HTTP::cookie httponly BIGipServerfoo enable } } } [root@ve11a:Active:Changes Pending] config curl -I http://172.28.20.16 HTTP/1.1 200 OK Date: Fri, 21 Jun 2013 06:58:06 GMT Server: Apache/2.2.3 (CentOS) Last-Modified: Thu, 23 May 2013 00:28:46 GMT ETag: "4185a8-59-c3efab80" Accept-Ranges: bytes Content-Length: 89 Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: BIGipServerfoo=1707657416.20480.0000;HttpOnly;Path=/;Version=1; - Bryce_Halkerst1
Nimbostratus
Aaron,
Thanks for you quick response. I just need the httponly flag for 2 cookies. Going to perform the following iRule on staging.
Thanks,
Bryce
when HTTP_RESPONSE {
Check if the response contains the Foo cookie
if {[HTTP::cookie BIGipServerWeblogic_Foo] ne ""}{
HTTP::cookie version BIGipServerWeblogic_Foo 1
HTTP::cookie httponly BIGipServerWeblogic_Foo enable }
Check if the response contains the FooBoo cookie
if {[HTTP::cookie FooBoo] ne ""}{
HTTP::cookie version FooBoo 1
HTTP::cookie httponly FooBoo enable }
}
} - galky_104921
Nimbostratus
I get the same error - illegal argument error on HTTP::cookie version. Any solution?
- have you read the replies above, one solution would be to set the version. did that work for you?
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com