CSM inserted cookie - session or persistant

Hi,
I am working on a requirement to load balance http requests to IBM WebSphere Application servers. Each server is configured on the CSM as one real server, but in reality there are several instances of the program running within the server. These instances are fault tolerant, so that if one of them should fail, another instance within the same server can take over and maintain the session. We currently stick clients based on the jsessionid. The problem with this is that if the instance within the server fails and another takes over, it will use a different cookie, and the stickyness is lost. Our requirement is to maintain stickyness to the same real server should an instance of the application fail. We have tried using the HTTP cookie insert feature, but this appears to be a persistant cookie that expires in 2010. We need this to be a session cookie (expires when the client's browser closes). I have seen this URL - http://www.cisco.com/en/US/partner/products/hw/switches/ps708/module_installation_and_configuration_guides_chapter09186a0080463841.html#wp1050708 which states that the CSM-S module will insert a session cookie. I know that the CSM inserts a persistant cookie. Can anyone tell me whether the cookie inserted by the CSM-S module is definitely a session cookie or not. Also, does anyone have any ideas as to how else I can resolve this issue. Many thanks in advance

The browser itself controls if it wants to keep a copy of the cookie for the session only if it want to save it.
The only thing the server, or CSM, can do is set an expiration date.
You can change the expiration to another static date if you think 2010 is too far away.
This is done with a variable.
Do a 'sho mod csm x var' to see which variable it is.
CSM-S is just a CSM with an on-board SSL module. So they act the same in this matter.
Also, even if it was a "session" cookie, I do not see how it would solve your issue.
If the client comes back with no cookie, it will not be sent to another instance of the same server - it will simply be loadbalanced among all the available servers.
What you would need is more like a cookie shared by all instances of the application on a particular server.
Then the CSM could match on the cookie to select a serverfarm that would only use instances running on this server.
Do you have the possibility to insert a static cookie in your application ?
Gilles.

Similar Messages

Catalyst 6500 CSM-S Cookie stickiness timout ?

/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin-top:0cm;
mso-para-margin-right:0cm;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0cm;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
Hi, anyone able to help with this ?
We have a CSM-S sitting in a 6513, at the moment we have IP stickiness applied for a Vserver/Serverfarm. The back end product vendor advises that cookie stickiness would be more appropriate for their application.
I have been scratching my head around the timeout of the inserted cookies; whatever I do they persist seemingly indefinitely, for example:
Just a test configuration with a 10minute sticky timout.
serverfarm applicationA
nat server
nat client applicationA_pool
failaction reassign
real 1.1.1.1
   inservice
real 1.1.1.2
   inservice
health retries 1 failed 120
probe applicationA_probe
sticky 1 cookie applicationA_sticky insert timeout 10
vserver applicationA-HTTP
virtual 2.2.2.10 tcp www
unidirectional
serverfarm applicationA
sticky 10 group 1
no persistent rebalance
inservice
Doing show mod csm 1 sticky
group   sticky-data              real                  timeout
1       cookie F5BF7115:F80EA688 1.1.1.1           0
1       cookie 4AFC972B:BB722437 1.1.1.2           0
Then a show mod csm 1 sticky config
Group NumEntries Timeout Type
1             82                           10        cookie-insert applicationA_sticky
When browsing to the VIP I see the application page via one of the reals. For the sake of the test I am using round-robin. Without cookies applied my browser will bounce between reals (I turned off persistent rebalance during testing) as expected.
With a sticky cookie inserted the browser stays on one of the real’s, however the timeout which I have applied does not work. The client will stay stuck to the real almost indefinitely (the actual cookie expiry is 2099!).
The online documentation advised that the method I am using should work as expected:
Quote
This example shows how to configure a virtual server named barnett, associate it with the server farm named bosco, and configure a sticky connection with a duration of 50 minutes to sticky group 12:
Router(config)# mod csm 2
Router(config-module-csm)# sticky 1 cookie foo timeout 100
Router(config-module-csm)# exit
Router(config-module-csm)#
Router(config-module-csm)# serverfarm bosco
Router(config-slb-sfarm)# real 10.1.0.105
Router(config-slb-real)# inservice
Router(config-slb-real)# exit
Router(config-slb-sfarm)#
Router(config-slb-sfarm)# vserver barnett
Router(config-slb-vserver)# virtual 10.1.0.85 tcp 80
Router(config-slb-vserver)# serverfarm bosco
Router(config-slb-vserver)# sticky 50 group 12
Router(config-slb-vserver)# inservice
Router(config-slb-vserver)# exit
Router(config-module-csm)# end
End Quote
I am guessing that sticky group 12 / 1 is a typo
Looking at the documentation, sticky can also be applied not in the vserver config but in a policy (this is how we are doing IP stickiness). I have tried both methods. Same result.
I am natting the client address to a private pool which then talks to the reals (and back). Would'nt expect this to be any issue.
The CSM is running Software version: 4.3(5).
Any help appreciated.

Good mornign Simon,
The behavior you are seeing is the expected one.
When the CSM is configured for cookie insertion, a static cookie value is created in the sticky table for each server. This is the cookie that is being inserted, using as expiration date the one defined in the COOKIE_INSERT_EXPIRATION_DATE variable.
With this stickiness method, there is no need to use a timeout, because, since the sticky table will only contain one entry for each server, it will never become full.
Quoting from the documentation:
Note     The
configurable timeout values are not applied when using cookie insert.
You can adjust the timeout value using the environment variables.
If you don't want to keep the cookies in the client for that long, another approach you can use is setting an empty date in the COOKIE_INSERT_EXPIRATION_DATE variable. When doing that, the cookie will be inserted without an expiration date, so it will be cleared when the browser is closed.
I hope this answers your question
Regards
Daniel

Cookie session

Hello
i am a litter new to coldfusion, I have just finish my first web site (using CF8 and MySql5)
My hosting server doesn’t enable session on CF8 plans (only on CF9)
I want to login users securely so they can edit or delete their Add
So I am obliged to upgrade to CF9 or use cookie session instead of CF or J2EE session
If any one has an idea how to login user using cookie session
If is it possible to give example code
Thank you very much

Hi,
          Try two different browser products. IE and Netscape ??
          Actually I feel url re-writing should work with multiple instances of same
          browser product.
          -Kuntal.
          Somasundaram wrote:
          > Dear Group,
          >
          > I am trying this simple click count jsp based on sessions. It works ok with
          > a single browser instance. But when i have multiple instances of the browser
          > from the same vendor, the session seems to be shared between these too
          > instances (because of cookie based session and cookie files are shared
          > between browser instances, i guess.). Trying to get separate sessions for
          > each browser instance. Tried disabling cookie based session and enable
          > URLRewriting based session. Nothing seems to work. Session is not maintained
          > and a new session is created for every access of the same JSP. Please
          > help...
          >
          > Thanks & Regards
          > Somasundaram
          >
          > --
          > -----------------------------------------------------
          > | E-mail: [email protected]
          > |
          > -----------------------------------------------------

Cookie session information not being stored

I consulted the documentation on cookie sessions ids for flex
and tried the sample code below but it does not work. It always
acts as if the data never gets stored (it always goes to the size
== 0 case for initialization). I double checked the Flash Player
settings and they are set up to store 100KB. What could be causing
this to fail?

Im working with a sort of cookie
[Bindable]
public var sharedObjectData:SharedObjectData =
SharedObjectData.getInstance();
private function initApplication():void
sharedObjectData.locallyStoredObject =
SharedObject.getLocal("sampleData");
if(sharedObjectData.locallyStoredObject.data.userStatus ==
null)
else
currentState = "loggedIn";
name_text.text =
sharedObjectData.locallyStoredObject.data.userStatus;
This works fine for me

Predictable Cookie Session IDs

I am running CF8 with all the lates hot-fixes and for the past couple of mints I have not had any issues with PCI. Yesterday - I failed with a "Predictable Cookie Session ID" remark. I do have Use UUID as CFToken checked as well as Use J2EE Session Vars. What and I missing?

based on what OWASP has to say
OWASP says
"Best practice calls for J2EE session management. In the
event that only ColdFusion session management is available, strong
security identifiers must be used. Enable this setting to change
the default 8-character CFToken security token string to a UUID.
http://www.owasp.org/index.php/Configuration"
It looks like the J2EE sessions are the way to go.
I believe the reason for the PCI flag is that the scan (at
least the one from the service we use) was looking at CFID alone. I
assume this because cftoken -was- set to use uuid so it should have
been secure. The scan probably doesn't know that cfid and cftoken
are used in conjunction. So in a way this is a false positive.
Based on the new standards coming in it is enough to be out of
compliance.
solution to be in compliance is to set clientmanagement="no"
and setclientcookies="no" in application.cfm so that cfid and
cftoken are not set at all By using only the jsessionid, you are
following best practices from OWASP and also get the benefits of
session end on browser close
Other thoughts still welcome

CSM Sticky Cookie Insert

Hello,
We have a Catalyst 6500 w/ CSM-S configuration that has 2 serverfarms with identical real servers using the same VIP. Each farm has 50 real servers (2 IPs with 25 consecutive ports each). One of the serverfarms is defined under a SLB policy with client NAT and the second one directly under the vserver. Both serverfarms are configured with the same sticky group for cookie insert. When I issue "show mod csm 13 sticky group 4" I only see 52 entries instead of 100. Also, some of the entries are duplicate. All the rest of the sticky groups are displaying the correct number of cookie entries, matching the number of real servers in the farms. Any ideas on why this is?

You probably have encountered the following bug fixed only in version 4.2.2
CSCsa74493
CSM: sticky insert table not updated if adding new reals
The workaround is to reboot the CSM or reconfigure reals, policy and vserver in the correct order.
Gilles.

Cookies won't persist

Hi, am assuming this is a simple problem, but Safari 4 Beta's cookies on one of my Macs won't persist from session to session. Having to re-log in to Amazon and Flickr and various news sites is getting tiresome. As far as I can tell, there isn't a preference that controls this.
I have deleted the file:
~/Library/Cookies/Cookies.plist
but that hasn't helped. Is there somewhere else I should look?
thanks for your help fixing this minor yet vexing problem

HI,
Maybe this isn't just a cookie issue.
Safari/Keychain fix:
Sounds like your Keychain preference files are corrupted. Locate this file:
com.apple.keychainaccess.plist /Users/YourName/Library/Preferences. Drag that file from your Preferences folder to the Trash, empty the Trash and reboot.
If that doesn't help...
1) Quit Safari
2) Open Keychain Access. (Applications/Utilities) Find the "Safari AutoFill" item. Delete it.
3) Relaunch Safari. Next time it asks for authorization, click "Always Allow".
Carolyn

ACE4710 insert cookie - does it overwrite server cookie?

I read the topic
http://docwiki.cisco.com/wiki/Session_Persistence_Using_Cookie_Insert_on_the_Cisco_Application_Control_Engine_Configuration_Example
(great one but unfortunately, doesn't answer my question).
I was trying to implement stickiness based on cookie. Server inserts a cookie and sends it to the browser. I learned from app team that this cookie is changing dynamically during the session, so stickiness based on server’s cookie doesn’t work.
Now I want to investigate into possibility of ACE to insert a cookie. My question is: ACE feature of “cookie insert”: does it add additional cookie into http header without removing server cookies or it deletes the cookie(s) that server put into http header and replaces them with its own cookie?
Thanks!

Hi Dmitriy
If you have different names for server cookie and cookie which ACE is going to insert - server's cookie won't be touched. ACE will just add its own one.

CSM - insert header source ip - lost when browser refresh

Hi,
inserting the client's ip address into the http header using a CSM works fine. But after a a browser refresh, the information is lost.
Is ther any way to overcome this?
Thank you
Darko

do you have configured 'persistent rebalance' ?
If yes, I would suggest to capture a trace to see what exactly occurs in the network when your browser does a refresh.
Gilles.

ACE - Load Balance insert cookie method for https

I am trying to load balance between 2 web servers using the cookie insert method by ACE for achieving the session persistence. The servers are not inserting any cookie. It works fine for the http connections but when trying with https connection it is not working.
Can anyone help me with this please.
Is it that ACE cookie insert method of session persistence will not work with https connections.

Hi,
1. for https you can use src ip as sticky (mega proxy problem).
2. you can terminate ssl connection on ace (ssl between client and ace only, between ace and server it's clear) and you can use any L7 sticky (for example cookie)
3. if you need ssl terminate up to real server, you can first terminate ssl between client and ace on ace, then use L7 sticky and after then terminate second ssl to real server.
in other words, if you don't decrypt ssl on ace, you can use only L2/3 data for sticky (or ssl id for ssl v2.0)
martin

How do I insert a session variable into a record?

I can’t figure out how to insert the value passed by a
session variable into a record.
I have a form I want to use to insert a record. I pass
session variables to this page and want to insert one of them into
the record. The session information is:
session_start();
$_SESSION['usename'] = $_POST['username'];
$idvar = $_SESSION['id'];
$_SESSION[‘id’] is the user_id that I want to
insert into the record.
I know $idvar is getting to the page with the form because I
can echo it.
The insert code looks like this:
if ((isset($_POST["MM_insert"])) &&
($_POST["MM_insert"] == "register")) {
$insertSQL = sprintf("INSERT INTO h_genres (user_id,
username, contrib_to, Advertising, Annual_Reports, Leader_Content,
Member_Content, Brochures) VALUES (%s, %s, %s, %s, %s, %s, %s,
%s)",
GetSQLValueString($_POST['user_id'], "int"),
GetSQLValueString($_POST['username'], "text"),
GetSQLValueString($_POST['contrib_to'], "text"),
GetSQLValueString(isset($_POST['Advertising']) ? "true" :
"", "defined","'Y'","'N'"),
GetSQLValueString(isset($_POST['Annual_Reports']) ? "true" :
"", "defined","'Y'","'N'"),
GetSQLValueString(isset($_POST['Leader_Content']) ? "true" :
"", "defined","'Y'","'N'"),
GetSQLValueString(isset($_POST['Member_Content']) ? "true" :
"", "defined","'Y'","'N'"),
GetSQLValueString(isset($_POST['Brochures']) ? "true" : "",
"defined","'Y'","'N'"));
mysql_select_db($database_hauw, $hauw);
$Result1 = mysql_query($insertSQL, $hauw) or
die(mysql_error());
I have a hidden field for the user_id:
<input name="user_id" type="hidden" id="user_id" />
I think I need to get the value in $idvar into user_id but I
don’t know how.
Any help is appreciated.

awsweb wrote:
> I have a hidden field for the user_id:
> <input name="user_id" type="hidden" id="user_id"
/>
>
> I think I need to get the value in $idvar into user_id
but I don?t know how.
<input name="user_id" type="hidden" id="user_id"
value="<?php echo
$idvar; ?>" />
David Powers
Adobe Community Expert
Author, "Foundation PHP for Dreamweaver 8" (friends of ED)
http://foundationphp.com/

Persistent cookies not staying persistent!

I'm a web developer and I use cookies on some of my sites to add to the functionality, for example: In an e-commerce site remembering to display only [User selected amount] of products instead of [All the products ] at once, depending on what the user has chosen. However I've been noticing that cookies set to be persistent are being deleted or removed like if they were temporary cookies, even when Firefox’s settings are not set to do that. This is a troubling issue and I'm starting to feel it may be a bug? IE, Safari, and Opera work completely fine with the given example and to the best of my ability Firefox (3.6) is set up to be saving these type of cookies. I've only noticed this issue after updating to the newest version of Firefox so is this a known bug?

It probably takes less than a second to restore them because those cookies are opt-out cookies that are created by the TACO extension. Such cookies can only be removed if you uninstall that extension.
Targeted Advertising Cookie Opt-Out (TACO): https://addons.mozilla.org/firefox/addon/11073
<blockquote>TACO with Abine prevents over 100 different online advertising networks (including Google, Microsoft and Yahoo) from displaying highly targeted advertisements using the detailed information on your web surfing habits. TACO disables most behavioral advertising by setting 100+ permanent, generic, non personally identifiable "opt-out" cookies directly into the browser.<br>
<br>
Unlike other opt-out solutions, this tool will make the opt out cookies completely persistent. That is, clearing the browser's cookies will delete all other installed cookies, except these.
</blockquote>

Save cookie/session after login on web service client

I am calling a web service that has a login method. It sets a session id in
a cookie. Every subsequent call fails and says I'm not logged in. How do I
save their cookie or session ID such that the server thinks I'm logged in?
Here's the client code (I used clientgen to create jar from wsdl);
DatashareManager dsm = new DatashareManager_Impl();
WebServiceContext wsContext = dsm.context();
WebServiceSession session = (WebServiceSession)wsContext.getSession();
DatashareManagerSoap dsmsoap = dsm.getDatashareManagerSoap();
String result = dsmsoap.login("username", "password"); // this works
EResult result2 = dsmsoap.deleteReusableList(1, "bob"); // this fails 'Not
logged in'

That sounds like a difficult one to implement because you'll essentially need to intercept the AppsLogin servlet (or AppsLocalLogin.jsp) to conditionally redirect the user somewhere else - and that would be an intrusive (and not recommended) customization.
Some possible alternatives:
1. Rather than publish http://hrlive.myintranet.local:8000/OA_HTML/AppsLogin as the URL that you users connect to, publish something like http://hrlive.myintranet.local:8000/OA_HTML/XxLogin.jsp instead. That could be a custom JSP that asks the user to agree to the disclaimer and, when they agree, store that agreement in a cookie and then redirect to AppsLogin.
That's not quite the same because you're asking the user to agree before they login. It also means that they can navigate direct to AppsLogin and bypass the disclaimer (unless you customize AppsLogin to verify the cookie).
2. Assign all users a default 'Disclaimer' responsibility with a single function (such as an EIT, or a custom OA Framework page) that allows the user to agree to agree to the disclaimer. Then once they've agreed to it have some process that automatically grants them their real responsibilities and revokes the Disclaimer responsibility. For example, if you used an EIT that could be an API User Hook.
One problem with this approach is that you'll need to clear cache through Functional Administrator before the new responsibilities are visible so you'll either need to find a way of doing that programatically or ask the user to wait until tomorrow (assuming you do a nightly web server bounce).

CSM disconnects VPN sessions upon config deployment.

CSM version 4.3 SP1
Hi,
I've noticed that while deploying configuration to our ASA5520 devices active VPN sessions are being disconnected.
Has anyone noticed the same ?
I've not found anything related in Cisco Forum.
I also have not found anything related at Cisco BugToolkit.
Thanks for help.
Krzysztof

and from asa device perspective (debug log):
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
Dec 28 13:43:51 [IKEv1]Group = ******, Username = ****, IP = ****, Session is being torn down. Reason: Administrator Reset
and lots more

Cookie session question

I wan't to know how to maintain session or cookie in a wap application.
As far as I know wap doesn't support(certainly current version) cookie.
my scenario is user login(i wan't to save its user id in the session)
He choose a brand then category then sku then enter sales from a input box.
I wan't tosave the sale with userid(i don't wan't to pass user id to each page)
So what can i do.
Please help as I am a new bie to WAP

woah, really? so would my best bet be to use a java
-> com bridge and then just re-login using that?Errr.
Okay here is the issue.
The browser should only send cookies back to the server (or domain actually) from whence they (the cookies) originally came. This prevents a malicious site from reading cookies set by other sites which is good for all sorts of reasons. Imagine for a moment if I could send you to a site where I could read the cookies set on this site. I could pretend to be logged in as you then.
So ultimatley if you want the browser to have a cookie it will send to a site it has to get it from that site in the first place and it shouldn't be getting it from somewhere else aka your code.
Does this help explain it better?

CSM inserted cookie - session or persistant

Similar Messages

Maybe you are looking for