Forum Discussion
omar_padilla
Altocumulus
Altocumulussecure cookies help!!!
success trying to establish secure cookies for a service that pass through my big-ip eh tried everything, but I can not do it.
Eh tried running an irule with the basic commands to enable the secure cookie but I had no success:
HTTP :: cookie secure "PHPSESSID" enable ---> this does not work
Then I went a little further capturing the set-cookie header by deleting it and overwriting it with the value of the cookie +; secure +; httponly
when HTTP_RESPONSE {
set ck [HTTP :: header values "Set-Cookie"]
local log0. "header first instance $ ck";
HTTP :: header remove "Set-Cookie"
foreach acookie $ ck {
if {$ acookie starts_with "PHPSESSID"} {
set stringe [string map {PHPSESSID PHPSESSID HttpOnly ""} $ acookie]
switch -glob $ acookie {
"*; HttpOnly *" -
"*; HttpOnly *" {
HTTP :: header insert "Set-Cookie" "$ stringe Secure; HttpOnly"
set ck2 [HTTP :: header values "Set-Cookie"]
local log0. "header2 $ ck2";
}
default {}
}
} else {
set stringes [string map {security security HttpOnly ""} $ acookie]
switch -glob $ acookie {
"*; HttpOnly *" -
"*; HttpOnly *" {
HTTP :: header insert "Set-Cookie" "$ stringes Secure; HttpOnly"
set ck3 [HTTP :: header values "Set-Cookie"]
local log0. "headerelse $ ck3";
}
default {}
}
}
}
}
If I can see that the texts are added in the header but when I do this the cookies do not appear in the browser and of course they are not safe.
I've tried many irules:
https://support.f5.com/csp/article/K11324
https://devcentral.f5.com/s/question/0D51T00006i7Wet/how-to-properly-insert-httponly-and-secure-cookie-directives
https://geekflare.com/f5-irule-to-secure-cookie-with-httponly-and-secure/
I am having an observation of the security area that I have to ensure those cookies and I don't know how to do it, since I only have the ASM module I cannot apply a persistence profile and I no longer have options
Who has come out?
jaikumar_f5MVP
Did you try in HTTP_RESPONSE_RELEASE, as there's a 302 response.
Yoann_Le_Corvi1Cumulonimbus
Hi
Have you tried simply in ASM, as you said you are using the module :
Security ›› Application Security : Headers : Cookies List ›› Edit Cookie
Yoann
omar_padillaThanks for your help, I wanted to know something.
eh validated that the cookies that the F5 inserts are something like TS00001 TS1552145, in this option that you indicate, can you write those cookies? replace them? What is the exact operation against the cookies it generates automatically?
- Yoann_Le_Corvi1
Hi
No the option I mentionned concerns cookies that your bachend application is sending. You can take action on them in ASM. It simply adds SECURE and HTTP Only attributes according to the settings.
Yoann
- Yoann_Le_Corvi1
Hi Omar,
Please mark this as answered if you have a moment :)
Yoann