For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

m1k3_56519's avatar
m1k3_56519
Icon for Nimbostratus rankNimbostratus
Feb 10, 2009

Set and proove the secure attribute in a cookie

Hello,

 

 

following szenario:

 

 

Internet - HTTPS - BigIP-ASM - HTTP - Webserver

 

 

The BigIP should terminate the SSL traffic and should send it via plain HTTP to the webserver. Should be no problem.

 

 

The webserver generates plain text cookies, the BigIP should transfer them via SSL and should also set the secure attribute.

 

 

Is this possible with the BigIP or is there an other way to solve this?

 

 

thx and have a nice day

 

 

mIke
app sec
BIG-IP Access Policy Manager (APM)
security

1 Reply

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Feb 16, 2009
    Hi Mike,

     

     

    There isn't such functionality in ASM. You could write an iRule which sets the Secure attribute on the cookie. You'd use the HTTP::cookie secure' (Click here) command in the HTTP_RESPONSE event. If you want help with this you could post in the iRule forum (Click here).

     

     

    Aaron