Technical Forum
Ask questions. Discover Answers.
cancel
Showing results for 
Search instead for 
Did you mean: 

Removal of Client Side F5 Persistence Pool Cookie

D_T
Cirrus
Cirrus

I am seeing the F5 persistence pool cookies showing on the client side browser when viewing via inspection tools:

BIGipServer~application~po*

I would like to remove these so the pools are not exposed to viewers of the website. I assigned the following rule to the VIP but it does not appear to be clearing these out:

 

when HTTP_RESPONSE_RELEASE {
set cookies [HTTP::cookie names]
foreach aCookie $cookies {
if {$aCookie matches_regex {^BIGipServer(?:[0-9a-fA-F]{6,8})(?:$|_[0-9]+$)}} {
# Remove ASM Cookies
HTTP::cookie remove $aCookie
}
}
}

 

1 ACCEPTED SOLUTION

Ismael_Goncalves
F5 Employee
F5 Employee

This is exactly how Cookie Persistence method works and if you remove the cookie you break the functionality. There are alternative cookie persistence methods you might consider. Check them below:

Overview of cookie persistence (f5.com)

In addition to it, I recommend you to enable encryption on your current cookie persistence method. This will prevent  malicious users to revert the value of the cookie into IP address of your pool member. 

View solution in original post

1 REPLY 1

Ismael_Goncalves
F5 Employee
F5 Employee

This is exactly how Cookie Persistence method works and if you remove the cookie you break the functionality. There are alternative cookie persistence methods you might consider. Check them below:

Overview of cookie persistence (f5.com)

In addition to it, I recommend you to enable encryption on your current cookie persistence method. This will prevent  malicious users to revert the value of the cookie into IP address of your pool member.