|
#Cookie Rewrite Rule |
|
#Used to rename cookies on request and response, |
|
#Allows client to see one cookie name while upstream sees another |
|
#Allows cookie renaming to only fire on specific set of domains |
|
#Also enables cookie path rewriting from root to specific path and vise versa |
|
#Array must be even number of domains for function to work |
|
#Requires blank stream rewrite profile to be enabled on VIP |
|
#By Pierce Fortin [email protected] |
|
#12/12/2017 v 1.0 |
|
when RULE_INIT |
|
{ |
|
set static::CookieDebugOn 0 |
|
} |
|
when CLIENT_ACCEPTED |
|
{ |
|
set logPrefix "[IP::client_addr]:[TCP::client_port]:CookieCOOKIE:\[HTTPS\]:\t" |
|
if { $static::CookieDebugOn } { log local0. "$logPrefix: Client accepted" } |
|
} |
|
|
|
when HTTP_REQUEST { |
|
#Take cookie being provided by the client and rename it inline before sending request to upstream server |
|
if { $static::CookieDebugOn } { log local0. "$logPrefix: ### Begin processing Incoming" } |
|
set isCookieDomain 0 |
|
STREAM::disable |
|
array set CookieDomains |
|
{ |
|
"wwwpoc.Cookie.com" |
|
"wwwstage.Cookie.com" |
|
"www.Cookie.com" |
|
"PlaceholderDomain.com" |
|
} |
|
foreach domain [array get CookieDomains] |
|
{ |
|
if { $static::CookieDebugOn } { log local0. "$logPrefix: Checking [HTTP::host] against $domain" } |
|
if { [string tolower [HTTP::host]] eq [string tolower $domain] } |
|
{ |
|
if { $static::CookieDebugOn } { log local0. "$logPrefix: Current request is an Cookie domain. Processing" } |
|
set isCookieDomain 1 |
|
if { $static::CookieDebugOn } { log local0. "$logPrefix: Current request is an Cookie domain. Set Cookie domain to 1" } |
|
set cookies [HTTP::cookie names] |
|
if { $static::CookieDebugOn } { log local0. "$logPrefix: Current request is an Cookie domain. Collecting Cookies and enumerating" } |
|
foreach cookie $cookies { |
|
if { $cookie eq "CLIENT-SIDE-COOKIE-NAME" } { |
|
if { $static::CookieDebugOn } { log local0. "$logPrefix: Current request is an Cookie domain. Found Cookie sessionID, Rewriting path and name" } |
|
set cookie_value [HTTP::cookie $cookie] |
|
set cookie_path [string map -nocase {"/PATH/" "/"} [HTTP::cookie path $cookie]] |
|
HTTP::cookie remove $cookie |
|
HTTP::cookie insert name SERVER-SIDE-COOKIE-NAME value $cookie_value path $cookie_path |
|
} |
|
|
|
} |
|
if { $static::CookieDebugOn } |
|
{ |
|
foreach cookie [HTTP::cookie names] { |
|
log local0. "Cookie name: $cookie, Cookie value: [HTTP::cookie value $cookie]" |
|
} |
|
} |
|
} |
|
} |
|
} |
|
|
|
when HTTP_RESPONSE { |
|
if { $static::CookieDebugOn } { log local0. "$logPrefix: Processing Response" } |
|
if { $isCookieDomain eq 1 } { |
|
if { $static::CookieDebugOn } { log local0. "$logPrefix: Current request is an Cookie domain. Rewriting cookie" } |
|
set cookies [HTTP::cookie names] |
|
foreach cookie $cookies { |
|
set cookie_value [HTTP::cookie $cookie] |
|
set cookie_path [string map -nocase {"/" "/PATH/"} [HTTP::cookie path $cookie]] |
|
HTTP::cookie remove $cookie |
|
HTTP::cookie insert name CLIENT-SIDE-COOKIE-NAME value $cookie_value path $cookie_path |
|
} |
|
} |
|
else { |
|
if { $static::CookieDebugOn } { log local0. "$logPrefix: Current response is not an Cookie domain. Disabling STREAM" } |
|
STREAM::disable |
|
} |
|
} |
This F5 iRule uses stream rewrites to rewrite cookie name and path. Useful for proxied content to secure cookie and conform to brand standards when required and unable to be supported by application.