Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a cookie; what is the difference between the Cookie and Set-Cookie headers?
Short answer
A cookie is a small piece of name=value information that the server stores in the browser; because HTTP is stateless, session, login and preference information is carried with cookies. The server gives the cookie with the Set-Cookie header in the response; in subsequent requests to the same site, the browser sends the cookie back with the Cookie header. In TR7, separate conditions read the two directions: User Cookie Name looks at the Cookie header in the request, Server Cookie Name looks at the Set-Cookie header in the response of the Backend Service and is used only at the response stage. Cookies also bind the user to the same Backend Service with the New Cookie, Current Cookie and Session Affinity Manager (SAM) options in the Persistence field of the HTTP vService; the HTTP Cookie Security action adds security attributes to cookies, and the Cookie Encryption action encrypts the value of the selected cookies.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Load Balancer → Conditions (Policy Match) → Criteria | User Cookie Name | A decision based on the presence or value of the cookie in the request |
| Load Balancer → Conditions (Policy Match) → Criteria | Server Cookie Name | A decision based on the cookie that the Backend Service gives with Set-Cookie; only at the response stage |
| Load Balancer → Load Balancer vService List → HTTP vService form | Persistence: New cookie, Current cookie, Session Affinity Manager (SAM) | Binding the user to the same Backend Service through a cookie |
| Load Balancer → Backend Services → Backend Service form | Cookie Content | The value that identifies this Backend Service in cookie-based persistence (New cookie, Current cookie or the Cookie Based Connection Persistency action) |
| Load Balancer → Actions (Policy Actions) | HTTP Cookie Security | Adding Secure, HttpOnly, SameSite=Strict to cookies |
| Load Balancer → Actions (Policy Actions) | Cookie Encryption | Keeping the value of the selected cookies encrypted on the client side |
Cookie and Set-Cookie
| Set-Cookie | Cookie | |
|---|---|---|
| Direction | Server → browser (response) | Browser → server (request) |
| Content | Name, value and attributes (Path, Domain, Expires, Secure, HttpOnly, SameSite) | Only name=value pairs |
| TR7 condition | Server Cookie Name | User Cookie Name |
The cookie is defined in RFC 6265.
Common Misconceptions
- "Cookie and Set-Cookie are the same header." One gives the cookie in the response, the other sends it back in the request; in TR7, they are read with separate conditions.
- "For persistence, the application has to generate a cookie." With the New Cookie option, TR7 adds the cookie; to make use of the application's own cookie, Current Cookie is selected (What is the difference between New Cookie and Current Cookie?).
- "Cookies are safe on the client side." The values can be read and changed by the user; attributes and encryption limit this (What are the Secure, HttpOnly and SameSite cookie attributes?).
How it is done in the documentation
