Bug 1368525

Summary: Secure cookie sent over plain HTTP when insecureEdgeTerminationPolicy allows both TLS and non-TLS
Product: OpenShift Container Platform Reporter: Josep 'Pep' Turro Mauri <pep>
Component: RoutingAssignee: Maru Newby <mnewby>
Status: CLOSED ERRATA QA Contact: zhaozhanqi <zzhao>
Severity: medium Docs Contact:
Priority: medium    
Version: 3.2.0CC: aos-bugs, bbennett, bmeng, eparis, erich, mnewby, tdawson
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Cause: When an edge-terminated Route had insecureEdgeTerminationPolicy set to Allow — meaning that the Route could be accessed by both http and https — the inserted session cookie was always flagged as Secure. Consequence: When a client connected over http the secure cookie would be dropped, breaking session persistence. Fix: Cookies for edge-terminated routes that allow insecure connections are set to be non-secure. Result: Session persistence for such routes is maintained.
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-09-27 09:45:14 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Josep 'Pep' Turro Mauri 2016-08-19 16:12:33 UTC
Description of problem:
When a Route is defined with TLS edge termination and insecureEdgeTerminationPolicy is set to Allow —meaning that the Route can be accessed both via http and https— the inserted session cookie is always flagged as Secure.

When connecting via HTTP this means that the client will drop it, breaking session persistence.

Version-Release number of selected component (if applicable):

openshift3/ose-haproxy-router:v3.2.1.9

How reproducible:
Always

Steps to Reproduce:
1. Create a Route with tls.termination=edge and tls.insecureEdgeTerminationPolicy=Allow
2. Access the route over plain HTTP

Actual results:

the session cookie is flagged as Secure both when accessing over HTTP and HTTPS

$ curl -si http://nodejs-mongodb-example-wonderland.test.sod.io/ | grep Set-Cookie
Set-Cookie: d4590b192758b8d77238014a0bf62c56=d681e9e03fd59798bb181a2d4f554775; path=/; HttpOnly; Secure
$ curl -ski https://nodejs-mongodb-example-wonderland.test.sod.io/ | grep Set-Cookie
Set-Cookie: d4590b192758b8d77238014a0bf62c56=d681e9e03fd59798bb181a2d4f554775; path=/; HttpOnly; Secure

Expected results:

the cookie should not be marked as Secure when the route is accessed over plain HTTP

Comment 4 Meng Bo 2016-08-23 08:13:11 UTC
Checked on OSE build v3.3.0.24

Issue has been fixed.

[user1@ose-master ~]$ oc get route
NAME                 HOST/PORT               PATH      SERVICES           PORT      TERMINATION
secured-edge-route   test-edge.example.com             service-unsecure   <all>     edge/Allow
[user1@ose-master ~]$ curl --resolve test-edge.example.com:443:10.66.141.94 https://test-edge.example.com/ -ksi | grep -i cookie
Set-Cookie: 856b4156ac0b95c408838f12ef7f9606=d32a4671f8f41f0d1a12fb20d80891a2; path=/; HttpOnly
[user1@ose-master ~]$ curl --resolve test-edge.example.com:80:10.66.141.94 http://test-edge.example.com/ -ksi | grep -i cookie
Set-Cookie: 856b4156ac0b95c408838f12ef7f9606=558525a7a02b24756fb18f087aab7be6; path=/; HttpOnly

Comment 6 errata-xmlrpc 2016-09-27 09:45:14 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2016:1933