How to: Set Enforcer Cookie Settings

WAF generates its own cookies and adds them on top of the application cookies.

These are called Enforcer Cookies.

You can control the attributes within these cookies:

• httpOnlyAttribute: Whether or not to add HttpOnly attribute, value is either true or false, default is true.

• secureAttribute: Whether or not to add Secure attribute, value is either always or never, default is always.

• sameSiteAttribute: In which mode to add SameSite attribute, value is one of: none-value, lax, strict or none, default is strict. Use none in order to not add this attribute to the cookie at all.

In this example, we configure enforcementType to be enforce, securedOverHttpsConnection to be true, sameSiteAttribute to be strict and type to be wildcard.

{
    "policy": {
        "name": "cookie_attrs_configured",
        "template": {
            "name": "POLICY_TEMPLATE_RATING_BASED"
        },
        "cookies": [
            {
                "name": "*",
                "accessibleOnlyThroughTheHttpProtocol": true,
                "enforcementType": "enforce",
                "securedOverHttpsConnection": true,
                "sameSiteAttribute": "strict",
                "type": "wildcard"
            }
        ]
    }
}