Forum Discussion

Chad_Roberts_21's avatar
Chad_Roberts_21
Icon for Nimbostratus rankNimbostratus
Jan 19, 2007

Securing Cookies

I use a simple rule to add ";Secure" to the end of ever "Set-Cookie" header in a particular app server's response, and it works great for what it was originally intended to do. when HTTP_RESPONSE...
application delivery
dev
devops
iRules
Shawn_Puckett_8's avatar
Shawn_Puckett_8
Icon for Nimbostratus rankNimbostratus
Jul 06, 2007
This seems to work on some of my cookies but not all, for example if I use Fiddler to look at the raw response I see:

 

 

HTTP/1.1 302 Found

 

Date: Fri, 06 Jul 2007 14:59:23 GMT

 

Location: /mysite/default.aspx

 

Set-Cookie: UserName=jdoe; path=/; HttpOnly

 

Set-Cookie: .ASPXAUTH=259AE6492D3; path=/; HttpOnly; Secure

 

 

So the code sets some but not others.

 

 

Any suggestions?

 

 

Thanks,

 

Shawn