HTTP::cookie¶

HTTP::cookie names
HTTP::cookie count
HTTP::cookie [value] <name> [<string>]
HTTP::cookie version <name> [version]
HTTP::cookie path <name> [path]
HTTP::cookie domain <name> [domain]
HTTP::cookie ports <name> [portlist]
HTTP::cookie insert name <name> value <value> [path <path>] [domain <domain>] [version <0 | 1 | 2>]
HTTP::cookie remove <name>
HTTP::cookie sanitize <name> [attribute]+
HTTP::cookie exists <name>
HTTP::cookie maxage <name> [seconds]
HTTP::cookie expires <name> [seconds] [absolute | relative]
HTTP::cookie comment <name> [comment]
HTTP::cookie secure <name> [enable|disable]
HTTP::cookie commenturl <name> [commenturl]
HTTP::cookie encrypt <name> <pass phrase> ["128" | "192" | "256"]
HTTP::cookie decrypt <name> <pass phrase> ["128" | "192" | "256"]

v11 Additions/Changes:
HTTP::cookie httponly <name> [enable|disable]
HTTP::cookie sanitize <-attributes|-names>

v12 Additions:
HTTP::cookie attribute <name> [insert <attribute> [value] | exists <attribute> | value <attribute> | remove <attribute> | names | count]

when HTTP_RESPONSE {

    log local0. "[IP::client_addr]:[TCP::client_port]:============================================"

    # Insert some test cookies in the response to the client to simulate cookies set by the application

    # Insert a cookie with name=cookie_name and value=cookie_value, path=/, SameSite=None, Secure flag set
    HTTP::cookie insert name "cookie_name" value "cookie_value" path "/"
    HTTP::cookie attribute "cookie_name" insert "SameSite" "None"
    HTTP::cookie secure "cookie_name" enable

    # Insert a cookie with name=cookie_name_2 and value=cookie_value_2, path=/, SameSite=strict
    HTTP::cookie insert name "cookie_name_2" value "cookie_value_2" path "/"
    HTTP::cookie attribute "cookie_name_2" insert "SameSite" "strict"

    # Insert a cookie with name=cookie_name_3 and value=cookie_value_3, path=/
    #   without SameSite set so we can modify that later in the iRule
    HTTP::cookie insert name "cookie_name_3" value "cookie_value_3" path "/"

    # Log the example Set-Cookie headers as if we got them from the application
    log local0. "[IP::client_addr]:[TCP::client_port]: \[HTTP::header values set-cookie\]: [HTTP::header values {set-cookie}]"

    set cookie_names [HTTP::cookie names]
    log local0. "[IP::client_addr]:[TCP::client_port]: \$cookie_names ([llength $cookie_names]): $cookie_names"
    foreach a_cookie $cookie_names {
        log local0. "[IP::client_addr]:[TCP::client_port]:"
        # Set the SameSite attribute to Strict if it's not set already
        if {not [HTTP::cookie attribute $a_cookie exists {SameSite}] }{
            log local0. "[IP::client_addr]:[TCP::client_port]: name=$a_cookie, setting SameSite to Strict"
            HTTP::cookie attribute $a_cookie insert "SameSite" "Strict"
        }

        # Loop through the attributes for this cookie
        set attr_names [HTTP::cookie attribute $a_cookie names]
        if { $attr_names ne "" }{
            log local0. "[IP::client_addr]:[TCP::client_port]: name=$a_cookie, SameSite exists? [HTTP::cookie attribute $a_cookie exists {SameSite}]"

            # Log the cookie attribute names and values
            foreach attr $attr_names {
                log local0. "[IP::client_addr]:[TCP::client_port]: name=$a_cookie, attribute $attr=[HTTP::cookie attribute $a_cookie value $attr]"
            }
        }
    }
}

# Example output of Set-Cookie headers from this iRule:
#   Set-Cookie: cookie_name=cookie_value;Path=/;SameSite=None;Secure
#   Set-Cookie: cookie_name_2=cookie_value_2;Path=/;SameSite=strict
#   Set-Cookie: cookie_name_3=cookie_value_3;Path=/;SameSite=Strict

# Log output from /var/log/ltm:
#      <HTTP_RESPONSE>: 10.1.1.8:51313: [HTTP::header values set-cookie]: {cookie_name=cookie_value;Path=/;SameSite=None;Secure}
#             {cookie_name_2=cookie_value_2;Path=/;SameSite=strict} {cookie_name_3=cookie_value_3;Path=/}
#      <HTTP_RESPONSE>: 10.1.1.8:51313: $cookie_names (3): cookie_name_2 cookie_name_3 cookie_name
#      <HTTP_RESPONSE>: 10.1.1.8:51313:
#      <HTTP_RESPONSE>: 10.1.1.8:51313: name=cookie_name_2, SameSite exists? 1
#      <HTTP_RESPONSE>: 10.1.1.8:51313: name=cookie_name_2, attribute Path=/
#      <HTTP_RESPONSE>: 10.1.1.8:51313: name=cookie_name_2, attribute SameSite=strict
#      <HTTP_RESPONSE>: 10.1.1.8:51313:
#      <HTTP_RESPONSE>: 10.1.1.8:51313: name=cookie_name_3, setting SameSite to Strict
#      <HTTP_RESPONSE>: 10.1.1.8:51313: name=cookie_name_3, SameSite exists? 1
#      <HTTP_RESPONSE>: 10.1.1.8:51313: name=cookie_name_3, attribute Path=/
#      <HTTP_RESPONSE>: 10.1.1.8:51313: name=cookie_name_3, attribute SameSite=Strict
#      <HTTP_RESPONSE>: 10.1.1.8:51313:
#      <HTTP_RESPONSE>: 10.1.1.8:51313: name=cookie_name, SameSite exists? 1
#      <HTTP_RESPONSE>: 10.1.1.8:51313: name=cookie_name, attribute Path=/
#      <HTTP_RESPONSE>: 10.1.1.8:51313: name=cookie_name, attribute SameSite=None
#      <HTTP_RESPONSE>: 10.1.1.8:51313: name=cookie_name, attribute Secure=

# Rename a cookie by inserting a new cookie name with the same value as the original.  Then remove the old cookie.
when HTTP_REQUEST {

   # Check if old cookie exists in request
   if { [HTTP::cookie exists "old-cookie-name"] } {

      # Insert a new cookie with the new name and old cookie's value
      HTTP::cookie insert name "new-cookie-name" value [HTTP::cookie value "old-cookie-name"]

      # Remove the old cookie
      HTTP::cookie remove "old-cookie-name"
   }
}

# Set the version to 1 first because HttpOnly can only be set for cookies with version 1 or 2 and the default version is 0:

# Set HttpOnly on all LTM and app generated cookies
when HTTP_RESPONSE {
   set cookieNames [HTTP::cookie names]
   foreach aCookie $cookieNames {
      HTTP::cookie version $aCookie 1
      HTTP::cookie httponly $aCookie enable
   }
}

# Or just for one statically defined cookie:
when HTTP_RESPONSE {
   HTTP::cookie version myCookie 1
   HTTP::cookie httponly myCookie enable
}