CORS implementation

Problem this snippet solves: Pretty self-explanatory - we had to implement CORS (Cross-Origin-Resource-Sharing) where we had multiple domains, all of which had to be able to make AJAX calls to API's...
Published Nov 03, 2015
Version 1.0
cors
devops
iRules
LTM
Cyril_M's avatar
Cyril_M
Icon for Altostratus rankAltostratus
Apr 12, 2017

Very useful code, and you can add that it solves an issue with the cookie persistence : when a browser sends a pre-flight request, by definition in RFC2616 it doesn't send any cookie with the OPTIONS method. So when the bigip receives the OPTIONS request, without cookie, it considers it as a new request, round robin the pool member, and in the http_reply the bigip includes a set_cookie ... The browser receives the set_cookie, thus drops the one it already had ... And voilà you lost your session :(

 

So with this iRule, the bigip doesn't send the pre-flight request to the pool member, and doesn't send a set_cookie back => your browser will keep the session cookie

 

Maybe F5 should consider a feature to not reply with a set_cookie to an OPTIONS request ?