Forum Discussion

Erlend_123973's avatar
Erlend_123973
Icon for Nimbostratus rankNimbostratus
Sep 16, 2014

How to securely present user supplied data in HTTP::respond NNN content

When i write iRules, I often use something like HTTP::respond 403 content "Error: variable $somevar not in datagroup" My concern here is, $somevar is userdefined data - often a part of HTTP::pa...
application delivery
devops
iRules
LTM
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Sep 16, 2014

I'd perhaps suggest two things:

  1. Set the HTTPOnly flag on all cookies. It's of course not a 100% solution, but it would prevent most script-based access to cookies.

  2. As WLB suggests, simply URI::encode the output value:

    HTTP::respond 403 content "Error: variable [URI::encode $somevar] not in datagroup"