So I've been looking into implementing HttpOnly and SecureCookies in my web environment. I have an F5 as the load balancer and a couple of C# web applications hosted in iis 7.5 for the website. The .net applications are an old asp.net legacy application and a newer MVC4 application.

I stumbled across this interesting article on how to implement the change. http://geekflare.com/f5-irule-to-secure-cookie-with-httponly-and-secure/

My question is, does setting the flags at the load balancer defeat the purpose? Will .Net honor the flags even if it was the load balancer that put them on?

Thanks, Alex


Making sure the cookies are only sent via ssl (secure) and making sure only the server can access the cookie (httponly) are client side protections, so it doesn't matter if they are set at the server or the intermediary (BIG-IP)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.