How do I secure cookies in HAProxy 2.2+ using an `http-response` line?

user_399704 0
Viewed 1376

I'm upgrading from HAProxy 1.8 to 2.2 and the command reqirep has been deprecated and removed. I used this previously to automatically add Secure to cookies that weren't previously secure. I want to use the new http-response syntax.

My old code looks like this:

rspirep ^(set-cookie:\ (?:(?!(\ Secure|ASPXAUTH=)).)*)$ \1;\ Secure

This adds ; Secure to any cookie header that doesn't contain Secure or ASPXAUTH=.

I'd like to do the same thing with one of the modern http-response commands.

Here's my initial translation:

http-request replace-header Set-Cookie (.*) %[src];\ Secure if { hdr_reg(Set-Cookie) -i (?!(\ Secure|ASPXAUTH=)) }
#                           Replace the "Set-Cookie" header
#                                       That contains any value
#                                           With the initial value with "; Secure" appended to the end
#                                                           If the cookie doesn't contain " Secure" or "ASPXAUTH=", ignoring case

Is this the right approach? Have you done this successfully?

haproxy
1 Answers

We ended up with this as a solution. It's not perfect because it will only look for Secure modifier on the end of the Set-Cookie line but it works for what we need.

  http-response replace-header Set-Cookie ^((?:.(?!\ [Ss]ecure))*)$ \1;\ Secure
user_3997040
Related