WAF cookie security policy allows the user to configure features that prevent cookie-based attacks, features such as cookie poisoning detection.

No—does not apply cookie tampering protection or encrypted cookie.

Signed—Prevents tampering by tracking the cookie. This option requires that the client supports cookies.

When the virtual server receives the first HTTP(S) request from a client, it uses cookie to track the session. After receiving the first response from the back-end server, Forti ADC will append ADC_SIGNED_COOKIE in Set-Cookie and record it into session table. Since the session tracking cookie includes a hash value that FortiADC uses to detect tampering cookie, if FortiADC determines the cookie from the client has changed, it will takes the specified action.

Encrypted—FortiADC encrypts set-cookie values which have been sent from back-end web server to clients. Clients can only see the encrypted cookies. FortiADC also decrypts cookies which have been submitted by clients before sending them to the back-end server to determine if a cookie attack has been placed.

Note: only for security-mode encrypted

All—will encrypt all the cookies.

List—will encrypt the cookie that match with the cookie-list.

Note: only for security-mode encrypted and if encrypted_cookie_type is list.

The cookie to be encrypted.

Note: only for security-mode encrypted; optional.

Determines whether FortiADC uses the IP address of a request to determine the owner of the cookie.

Enable—If cookie replay is enabled, the client IP address will be appended to the set-cookie value before encryption. If X-forward header exists, FortiADC will use its IP. Otherwise src IP will become the client IP. Once FortiADC receives it, the cookie will be decrypted and FortiADC will check if the IP address matches with the client IP.

Since the public IP of a client is not static in many environments, we recommend that you do not enable cookie-replay.

Note: only for security-mode encrypted.

Determines whether FortiADC allows requests that contain cookies which FortiADC does not recognize by encrypted cookie function or with missing cookies.

When cookie-replay is enabled, the suspicious cookie is a missing cookie that tracks the client IP address.

In many cases, when you first introduce the cookie security features, cookies that client browsers have cached earlier generate false positives. To avoid this problem, either select Never, or select Custom and enter an appropriate date on which to start taking the specified action against suspicious cookies.

Never—never allow suspicious cookies.

Always—always allow suspicious cookies.

Custom—Don't Block suspicious cookies Until dont_block_until specified date.

Note: only for security-mode encrypted.

WAF action.

Log severity.

Note: for security-mode encrypted/signed.

Accepts the request, but removes the cookie before sending it to the backend web server.

Note: cookie attribute.

Enable—add "HTTPOnly" flag to cookies. The HttpOnly attribute limits the scope of the cookie to HTTP requests. In particular, the attribute instructs the user agent to omit the cookie when providing access to cookies via "non-HTTP" APIs (such as a web browser API that exposes cookies to scripts).

Note: cookie attribute.

Enable—adds the secure flag to cookies. The Secure attribute limits the scope of the cookie to "secure" channels (where "secure" is defined by the user agent). When a cookie has the Secure attribute, the user agent will include the cookie in an HTTP request only if the request is transmitted over a secure channel, typically HTTP over Transport Layer Security (TLS).

Note: cookie attribute.

Default value is 0 (do nothing), range 0- 65535.

Add the maximum age (in minutes) if the response from backend server does not have an “Expires” or “Max-Age” attribute.