ADC

Use case: How to force Secure and HttpOnly cookie options for websites using the Citrix ADC appliance

September 14, 2021

Contributed by:

网络管理员可能会迫使安全、或HttpOnly, or both the flags on the Session ID and the authentication cookies that are generated by the web applications. You can modify the Set-cookie headers to include these two options by using an HTTP load balancing virtual server and rewrite policies on a Citrix ADC appliance.

HttpOnly- This option on a cookie causes the web browsers to return the cookie using the HTTP or HTTPS protocol only. The non-HTTP methods such as JavaScript document.cookie references cannot access the cookie. This option helps in preventing cookie theft due to cross-site scripting.

NOTE

You cannot use the HttpOnly option when a web application requires access to Cookie contents by using a client-side script, such as JavaScript or a client-side Java Applet. You can use the method mentioned in this document to rewrite only the server-generated cookies and not the cookies generated by Citrix ADC appliance. For example, AppFirewall, persistence, VPN session cookies and so on.
Secure- This option on a cookie causes the web browsers to return only the cookie value when the transmission is encrypted by SSL. This option can be used to prevent cookie theft through connection eavesdropping.

NOTE

The following procedure is not applicable for VPN virtual servers.

配置Citrix ADC设备强迫Secure and HttpOnly flags for an existing HTTP virtual server by using CLI

Create a rewrite action.
This example is configured to set both Secure and HttpOnly flags. If either one is missing, modify it as necessary for other combinations.
```
add rewrite action act_cookie_Secure replace_all http.RES.full_Header "\"Secure; HttpOnly; path=/\"" -search "regex(re!(path=/\\; Secure; HttpOnly)|(path=/\\; Secure)|(path=/\\; HttpOnly)|(path=/)!)" -bypassSafetyCheck YES 
```
This policy replaces all instances of “path=/”, “path=/; Secure”, “path=/; Secure; HttpOnly” and “path=/; HttpOnly” with “Secure; HttpOnly; path=/”. This regular expression (regex) fails if the case doesn’t match.

Create a rewrite policy to trigger the action.

                add rewrite policy rw_force_secure_cookie "http.RES.HEADER(\"Set-Cookie\").EXISTS" act_cookie_Secure 
               

Bind the rewrite policy to the virtual server to be secured. IfSecureoption is used, an SSL virtual server must be used.

                bind lb vserver mySSLVServer -policyName rw_force_secure_cookie -priority 100 -gotoPriorityExpression NEXT -type RESPONSE 
               

Examples:

The following example shows the cookie before setting the httpOnly flag

Set-Cookie: CtxsAuthId=C5614491; path=/Citrix/ProdWeb

The following example shows the cookie after setting the httpOnly flag

Set-Cookie: CtxsAuthId=C5614491; Secure; HttpOnly; path=/Citrix/ProdWeb/

配置Citrix ADC设备强迫Secure and HttpOnly flags for an existing HTTP virtual server by using GUI

Navigate toAppExpert > Rewrite > Actions, and clickAddto add a new rewrite action.
Navigate toAppExpert >修改>政策, and clickAddto add a new rewrite policy.
Navigate toTraffic Management > Load Balancing > Virtual Servers, and then bind the rewrite (response) policy to the corresponding SSL virtual server.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Use case: How to force Secure and HttpOnly cookie options for websites using the Citrix ADC appliance

September 14, 2021

Contributed by:

September 14, 2021

Contributed by:

Use case: How to force Secure and HttpOnly cookie options for websites using the Citrix ADC appliance

配置Citrix ADC设备强迫Secure and HttpOnly flags for an existing HTTP virtual server by using CLI

配置Citrix ADC设备强迫Secure and HttpOnly flags for an existing HTTP virtual server by using GUI

In this article