Cookie Ticket Identity Propagator
This plugin is usually used together with an entry component that keeps the authentication ticket cookie from being sent to the client and therefore from being exposed to external attacks.
If you intend to send the cookie to the client, it must be protected accordingly by choosing an appropriate ticket encoder.
cookieName) Note that only one cookie per cookie path and name can exist. Make sure that this cookie name does not clash with other cookie's names. For example, do not use session cookie names such as "JSESSIONID".
cookiePath) If one single authentication ticket is used for all applications, the value "/" can be used. If different tickets are used for different applications, the applications path should be used.
Note that only one cookie per cookie path and name can exist. Make sure that this cookie name does not clash with other cookie's names. For example, do not use session cookie names such as "JSESSIONID".
Make sure the configuration flag Interpret Cookie Domains is set in the Airlock Gateway (WAF) configuration. If not, the cookie path is ignored and cookies in the cookie store are sent to any back-end HTTP request of the same session. This also means that there may be only one cookie per cookie name!
It is best to consult the corresponding documentation of the web entry server or reverse proxy to get more accurate information on cookie handling.
cookieDomain) Because of security restrictions in browsers (same origin policy) it is usually not possible to set a cookie for a different domain unless the right-most two domain parts (e.g. "ergon.ch") are equal to that of the application setting the cookie.
It is possible that there are further restrictions regarding this in browsers.
If you are using a HTTP reverse proxy that stores the cookie in its session store (and does not send it to the client), make sure to understand the proxies interpretation of the cookie domain and cookie path.
Make sure the configuration flag Interpret Cookie Domains is set in the Airlock Gateway (WAF) configuration. If not, the cookie domain is ignored and cookies in the cookie store are sent to any back-end HTTP request of the same session. The cookie path is also ignored, meaning that there may be only one cookie per cookie name!
Airlock also supports the following cookie domain values (if the flag Interpret Cookie Domains is set):
- An empty value results in the cookie only being sent to the origin server that set the cookie.
- The value
.*results in cookies being sent to all back-end servers. This is especially useful if one authentication ticket is used for multiple back-ends. - The value
@<fully-qualified-host>results in the cookie being treated as if it were set by the host specified by "<fully-qualified-host>". If using this value, make sure the corresponding mapping also uses the fully qualified hostname.
If one single authentication ticket is used for all applications, the value ".*" can be used. If different tickets are used for different applications, the applications path should be used.
ticketService) ticketEncoder) Caution:This plugin is usually used together with an entry component that keeps the authentication ticket cookie from being sent to the client and therefore from being exposed to external attacks.
If you intend to send the cookie to the client, it must be protected accordingly by choosing an appropriate ticket encoder.
Note that some ticket encoders do not support ticket expiry, i.e. they do not encode the ticket validity into the ticket.
keyValuePairs) If supported by the ticket service plugin, this is a way to add such an extra key-value-pair to a ticket.
The key-value-pairs are added to the key-value-pairs passed to this plugin by the calling application. It overwrites existing values with the same key.
urlEncodingScheme) Make sure that the component receiving the ticket uses the same URL encoding scheme.
disableUrlEncoding) true, the cookie's final value is not URL-encoded, though the key/values will always be.
Notice that this may result in V1 cookies because the value will most probably contain the '=' character which is not allowed in V0 cookies. Make sure your application supports V1 cookies when disabling this property.
setSecureFlagInCookie) If the cookie is marked as secure, the browser (and any HTTP proxy behaving like a browser) should send the cookie only over secure connections.
Caution: If you think that setting this flag makes your application more secure, it is in most cases way better to adequately secure the authentication ticket by choosing a secure ticket encoder plugin. Remember that this flag just "asks" the browser to not transmit the cookie over unencrypted connections.
type: CookieTicketIdentityPropagator
id: CookieTicketIdentityPropagator-xxxxxx
displayName:
comment:
properties:
cookieDomain:
cookieName:
cookiePath: /
disableUrlEncoding: false
keyValuePairs:
setSecureFlagInCookie: false
ticketEncoder:
ticketService:
urlEncodingScheme: UTF-8