CODEWITHSUNDEEP
cookieshttponlyf5irule
Oliviattt
Oliviattt

Reputation: 11

F5 iRule to Secure Cookie with HTTPOnly and Secure but not contains cookie name="cnlfsid"

We need to Secure Cookie with HTTPOnly and Secure but not contains a cookie name ="cnlfsid"

Here is my code:

when HTTP_RESPONSE { 
    foreach x [HTTP::cookie names] {

        set ckname $x
        set ckvalue [HTTP::cookie value $x]
        set ckpath [HTTP::cookie value path]

        if {!($ckname equals "cnlfsid")} {
            HTTP::cookie remove $x
            HTTP::cookie insert name $ckname value $ckvalue path $ckpath version 1
            HTTP::cookie secure $ckname enable
            HTTP::cookie httponly $ckname enable    
        }
    }
}

but it can't work. Can someone help me to fix it.

Many thanks

Upvotes: 1

Views: 2435

Answers (1)

jpvantuyl
jpvantuyl

Reputation: 604

The answer from the f5 forum noted in the comments is:

when HTTP_RESPONSE {
    foreach x [HTTP::cookie names] {
        if { $x equals "cnlfsid" } {
            continue
        }
        set ckname $x
        set ckvalue [HTTP::cookie value $x] 
        set ckpath [HTTP::cookie $x path]
        HTTP::cookie remove $x
        HTTP::cookie insert name $ckname value $ckvalue path $ckpath version 1
        HTTP::cookie secure $ckname enable
        HTTP::cookie httponly $ckname enable
    }
}

Looks like the trick is the continue statement.

Upvotes: 0

Related Questions