Red Hat Bugzilla – Bug 1368525
Secure cookie sent over plain HTTP when insecureEdgeTerminationPolicy allows both TLS and non-TLS
Last modified: 2017-03-08 13:26 EST
Description of problem: When a Route is defined with TLS edge termination and insecureEdgeTerminationPolicy is set to Allow —meaning that the Route can be accessed both via http and https— the inserted session cookie is always flagged as Secure. When connecting via HTTP this means that the client will drop it, breaking session persistence. Version-Release number of selected component (if applicable): openshift3/ose-haproxy-router:v3.2.1.9 How reproducible: Always Steps to Reproduce: 1. Create a Route with tls.termination=edge and tls.insecureEdgeTerminationPolicy=Allow 2. Access the route over plain HTTP Actual results: the session cookie is flagged as Secure both when accessing over HTTP and HTTPS $ curl -si http://nodejs-mongodb-example-wonderland.test.sod.io/ | grep Set-Cookie Set-Cookie: d4590b192758b8d77238014a0bf62c56=d681e9e03fd59798bb181a2d4f554775; path=/; HttpOnly; Secure $ curl -ski https://nodejs-mongodb-example-wonderland.test.sod.io/ | grep Set-Cookie Set-Cookie: d4590b192758b8d77238014a0bf62c56=d681e9e03fd59798bb181a2d4f554775; path=/; HttpOnly; Secure Expected results: the cookie should not be marked as Secure when the route is accessed over plain HTTP
Checked on OSE build v3.3.0.24 Issue has been fixed. [user1@ose-master ~]$ oc get route NAME HOST/PORT PATH SERVICES PORT TERMINATION secured-edge-route test-edge.example.com service-unsecure <all> edge/Allow [user1@ose-master ~]$ curl --resolve test-edge.example.com:443:10.66.141.94 https://test-edge.example.com/ -ksi | grep -i cookie Set-Cookie: 856b4156ac0b95c408838f12ef7f9606=d32a4671f8f41f0d1a12fb20d80891a2; path=/; HttpOnly [user1@ose-master ~]$ curl --resolve test-edge.example.com:80:10.66.141.94 http://test-edge.example.com/ -ksi | grep -i cookie Set-Cookie: 856b4156ac0b95c408838f12ef7f9606=558525a7a02b24756fb18f087aab7be6; path=/; HttpOnly
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2016:1933