Project

General

Profile

Actions
Copy link

Bug #13343

closed

HAproxy cookie protection syntax needs updated

Added by Johannes Goldynia over 2 years ago. Updated over 1 year ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
haproxy
Target version:
-
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
22.05
Affected Architecture:
All

Description

A bug has been found after UPdate to pfSense plus 22.05: the generated code by HaProxy-GUI

rspirep ^(Set-Cookie:((?!;\ secure).)*)$ \1;\ secure if { ssl_fc }

used by the checkbox /backend settings ... HSTS / Cookie protection is obsolete.
So I fix it - temporary - by disabling the checkbox but adding the following "Backend pass thru":

http-response replace-header Set-Cookie "^((?:(?!; [Ss]ecure\b).)*)\$" "\1; secure" if { ssl_fc }

Still waiting for a fix in the GUI of haproxy.

Related issues

Has duplicate Bug #14536: Backend cookie protection option generates invalid haproxy config fileDuplicate

Actions
Actions
Copy link

Also available in: Atom PDF