Forum Discussion

Santavi_241428's avatar
Santavi_241428
Icon for Nimbostratus rankNimbostratus
Jul 22, 2016

httpCookies requireSSL="true" httpOnlyCookies="true"/

HI All,

 

Sorry for the heading but do not know how to post this. We have a set up. Web servers are behind the Virtual server. Any way the set up was running fine till our security team asked for a change in code for the servers

 

This is the code "httpCookies requireSSL="true" httpOnlyCookies="true"/" on server side.After this change Load balancing is not happening via load balancer/F5.Bypassing the VIP and accesing via NLB configured on the server side seems working for the users. By checking it came to know cert was installed on the NLB.Removed it but that also did not work. Can anyone help here? tried to search on internet and did not get quite answer what is the meaning of this piece of code.

 

5 Replies

  • Are you terminating SSL on the F5 for the Virtual Server ? This would be a good 1st step. More information around your configuration and which ports the VS are listening would be good.

     

  • OK. Somehow today the issue resolved but questions are unanswered. On the real servers which were acted as pool member above piece of code written and a cert is being used. Now On my Virtual server there was client ssl profile from the start. The cert is same on both the F5 client ssl profile and on the server .After the above piece of code written and the certs were installed on the servers users were getting the following error while logging in to the site(the site means the are actually accessing the virtual server ip)“the application is configured to issue secure cookies. These cookies require the browser to issue the request over ssl(https protocol).However the current request is not over ssl.”

     

    What I understood form this is the error is pointing that the request between the pool member and the virtual server should be on ssl ultimately. Doing a step by step troubleshooting by with user I 1 st created a pool with same ip by using 443 as port number. Although that worked for pool member level and the VIP was also up but the site kept loading state all time and the page itself does not come up. I thought then it might be the cert which is bind to the server itself needs to be on the F5 also since the connetion requires both the ssl and cookie options to be true end to end from user to end server. What I mean is that may be that code is implying that same cert needs to be seen on ssl communication between user machine and the end server. Not sure on this. Can anybody help what actually happened?

     

    Issuer reosve d by using a pool by using 443 as a monitor and using the same cert by creating ssl server profile

     

  • Update on this. I did change the server certificate profile a bit and tested successful. I changed it to default cert used by F5 and tested and it also successful. So using the same cert for both client and server profile is not required. I selected "serverssl" profile which eventually has no certificate in it. certificate and key both set to none.....Any idea what is going on here?

     

  • Update on this. I did change the server certificate profile a bit and tested successful. I changed it to default cert used by F5 and tested and it also successful. So using the same cert for both client and server profile is not required. I selected "serverssl" profile which eventually has no certificate in it. certificate and key both set to none.....Any idea what is going on here?

     

  • Update on this. I did change the server certificate profile a bit and tested successful. I changed it to default cert used by F5 and tested and it also successful. So using the same cert for both client and server profile is not required. I selected "serverssl" profile which eventually has no certificate in it. certificate and key both set to none.....Any idea what is going on here?