Secure Cookies Using HAProxy Enterprise

blog20221028-01.txt

Set-Cookie: User=Seb; path=/; Secure; HttpOnly

blog20221028-02.txt

set-cookie: Cookie1=Value1
set-cookie: Cookie2=Value-of-cookie2
set-cookie: Cookie3=Other-value; path=/

# Same result, but using header folding
set-cookie: Cookie1=Value1
set-cookie: Cookie2=Value-of-cookie2, Cookie3=Other-value; path=/

blog20221028-03.cfg

backend webservers
  [...]
  cookie SRV insert indirect httponly secure
  server s1 192.168.0.101:80 check cookie s1
  server s2 192.168.0.102:80 check cookie s2

blog20221028-04.txt

set-cookie: Cookie1=Value1
set-cookie: Cookie2=Value-of-cookie2, Cookie3=Other-value; path=/
set-cookie: SRV=s1; path=/; HttpOnly; Secure

blog20221028-05.cfg

acl https          ssl_fc
acl secured_cookie res.hdr(Set-Cookie),lower -m sub secure
rspirep ^(set-cookie:.*) \1;\ Secure if https !secured_cookie

blog20221028-06.txt

set-cookie: Cookie1=Value1, Cookie2=Value-of-cookie2; HttpOnly
set-cookie: Cookie3=Other-value; path=/

blog20221028-07.cfg

acl http_cookie res.hdr(Set-Cookie),lower -m sub httponly
http-response replace-header Set-Cookie "(.*)" "\1; HttpOnly" if !http_cookie

blog20221028-08.txt

set-cookie: Cookie1=Value1, Cookie2=Value-of-cookie2; HttpOnly
set-cookie: Cookie3=Other-value; path=/
set-cookie: SRV=s1; path=/

blog20221028-09.sh

# Enterprise edition
/opt/hapee-2.6/sbin/hapee-lb -vv | grep 'Built with PCRE'

# Community edition
haproxy -vv | grep 'Built with PCRE'

blog20221028-10.sh

Built with PCRE2 version : 10.32 2018-09-10

blog20221028-11.cfg

http-response replace-header Set-Cookie '(^((?!(?i)httponly).)*$)' "\1; HttpOnly"

blog20221028-12.txt

set-cookie: Cookie1=Value1, Cookie2=Value-of-cookie2; HttpOnly
set-cookie: Cookie3=Other-value; path=/; HttpOnly
set-cookie: SRV=s1; path=/

blog20221028-13.cfg

http-response replace-value Set-Cookie '(^((?!(?i)httponly).)*$)' "\1; HttpOnly"

blog20221028-14.txt

set-cookie: Cookie1=Value1; HttpOnly, Cookie2=Value-of-cookie2; HttpOnly
set-cookie: Cookie3=Other-value; path=/; HttpOnly
set-cookie: SRV=s1; path=/

blog20221028-15.cfg

http-after-response replace-value Set-Cookie '(^((?!(?i)httponly).)*$)' "\1; HttpOnly"

blog20221028-16.txt

set-cookie: Cookie1=Value1; HttpOnly, Cookie2=Value-of-cookie2; HttpOnly
set-cookie: Cookie3=Other-value; path=/; HttpOnly
set-cookie: SRV=s1; path=/; HttpOnly

blog20221028-17.txt

Set-Cookie: Cookie1=Value1; expires=Tue, 27-Sept-2023 09:14:05 GMT

blog20221028-18.txt

Set-Cookie: Cookie1=Value1; expires=Tue; HttpOnly, 27-Sept-2023 09:14:05 GMT; HttpOnly

blog20221028-19.cfg

http-after-response replace-header Set-Cookie '(^((?!(?i)httponly).)*$)' "\1; HttpOnly"

blog20221028-20.cfg

frontend www_fe
  bind :80
  bind :443  ssl crt my-cert.pem
  mode http

  use_backend www_be

  http-after-response replace-header Set-Cookie '(^((?!(?i)httponly).)*$)' "\1; HttpOnly"
  http-after-response replace-header Set-Cookie '(^((?!(?i)secure).)*$)' "\1; Secure" if { ssl_fc }

backend webservers
  mode http
  cookie SRV insert indirect
  server s1 192.168.10.101:8000 check cookie s1
  server s2 192.168.10.102:8000 check cookie s2