Forum Discussion

AshuA_246482's avatar
AshuA_246482
Icon for Nimbostratus rankNimbostratus
Nov 30, 2017

adding httponly flag in rule breaks the website

When i apply a irule on https-VIP to add httponly flag for all cookies, the site stop working. Any idea ? i_rule : when HTTP_RESPONSE { foreach mycookie [HTTP::cookie names] { HTTP::cookie httponly $mycookie enable } }

 

Thanks

 

application delivery
LTM

1 Reply

Sort By
  • eey0re_68979's avatar
    eey0re_68979
    Icon for Altocumulus rankAltocumulus
    Dec 01, 2017

    The 

    HttpOnly
    flag on a cookie means that the cookie is not visible to any JavaScript which runs in the browser. If setting it breaks your site, then that cookie must be used by scripts on the page.

    Further reading: OWASP, MDN.