Section – Application Cookies

How the cookie store works

In session-based communication, Airlock Gateway extracts cookies from back-end HTTP responses and stores them in its secure cookie store by default. These cookies are not sent to the client side. Instead, Airlock Gateway re-inserts them into HTTP requests on behalf of the web client. This allows cookies to be used securely for sharing data between back-end applications, for example in SSO scenarios.

The cookie store is limited to 32 KB per session. If required, you can change this limit for the security gate on the Expert Settings page (see the default settings file). In sessionless communication, the secure cookie store cannot be used. Instead, cookies are encrypted before they are sent to the web client, preventing cookie manipulation.

If specific cookies should neither be stored nor encrypted by Airlock Gateway, configure the corresponding prefixes as described below.

GUI

Description

Interpret cookie domains in cookie store

This checkbox defines whether Airlock Gateway interprets the domain and path attributes of cookies stored in the cookie store. If enabled, Airlock Gateway sends cookies from the cookie store to back-end hosts as follows:

  • If no domain attribute is specified, the cookie is sent only to the origin server that set it.
  • If a domain attribute is specified, the cookie is sent to back-end servers whose domain matches the cookie domain.
  • If both domain and path attributes are specified, the cookie is sent to back-end servers whose domain and path match the corresponding cookie values.
  • If only a path attribute is specified, the cookie is sent only to its origin server and only if the cookie path is a prefix of the request path.

This behavior is similar to a web browser. Airlock Gateway adds the following enhancements:

  • If the cookie domain is set to .*, the cookie is sent to all back-end servers. This is useful for cookies such as authentication assertion cookies that must be sent to all back-end servers, while other cookies still benefit from domain interpretation.
  • If the cookie domain is set to <fully-qualified-host>, the cookie is interpreted as if it had been issued by that host. For example, if the back-end host name is addon.tomcat, the resulting domain is .addon.tomcat. This can be used to issue session cookies on behalf of other back-end hosts, for example for form-based on-behalf login.
 
Notice

To fully benefit from cookie domain interpretation, use fully qualified host names for back-end hosts.

If the checkbox is disabled, Airlock Gateway appends all cookies in the cookie store to every HTTP request. Airlock Gateway does not store multiple cookies with the same name in the cookie store; the last cookie set for a name takes precedence.

Passphrase for encrypting cookies and URLs

Specifies the passphrase for passphrase-based encryption (PBE). Airlock Gateway derives a binary key from the passphrase using cryptographically secure message digest functions. All cookies encrypted with passphrase-based encryption can be decrypted and verified as long as the same passphrase is used. This makes them independent of any application session. The same passphrase is also used for URL encryption in mappings where PBE is selected.

Further information