>   

Hello,

Having a new problem that I think a directive in Pound can fix... I just 
don't speak HTTP very well.

Pound is running two instances on Port 80 & 443

When folks log in to secure/443 site, a user cookie is set, and Pound 
will handle session management by keeping that user on the same backend 
box for 20 min (1200 sec).

We use Websphere for the BackEnd, and went from 5.1.1 to 6.0 when this 
problem appeared.

So requests come into our environment on 443, Pound takes them, decodes 
the SSL, and passes the request to one of the BackEnd servers on port 
80... The BackEnd servers ask for log in info, and set a cookie called 
user, so that Pound keeps them on the same server.  The cookie is set, 
but Pound can't keep them on the same server.

In testing, when presented with a new server, we can log on to each 
BackEnd Server and the WebSphere box keeps us logged in to each.  Pretty 
soon we're logged into all of them for every third or fourth request.

So the cookie is set, the browser has it correctly (almost), and the 
BackEnd WS boxes keep the user logged in to the each backend system... 
but Pound seems to ignore it.

So then I use Mozilla's cookie management tool, and notice that the 
cookie user is NOT set as a secure cookie.

Our non-secure site of this domain is a marketing site, having nothing 
to do with this transaction.  So I think our WS app, because It thinks 
its a port 80 machine is sending out cookies for our port 80 marketing 
site instead of our port 443 web app.

How do I add/translate the header information for these cookies to 
reflect these 443 vs. 80 problem?  Is there are directive?  How do I 
make Pound modify WebSphere's outgoing cookie sets be secure/443 when it 
thinks it a non-secure 80 server?

Thanks,

-Jon Cyr
cyrj(at)cyr.info

Pound's been very good to us for a few years, and I wear too many hats 
to know this HTTP protocol stuff very well,

On Tue, 12 Jul 2005 18:18:29 -0400 Jonathan Cyr <cyrj(at)cyr.info> wrote:
[...]

A "secure cookie" is like a regular cookie but has the attribute
"secure" set. In HTTP it looks a bit like

Set-cookie: name=value; secure

The "secure" is an indication for the client that only secure channels
should be used to transmit this cookie. There is no definition (e.g. RFC
2965) what these secure channels might be.

 Pound does not particularly care about the "secure" bit - if your
server sets it it is just passed through.

I think you really want to look at the WebSphere config - something
obviously changed in the transition from 5.x to 6 and the "secure" is no
longer being set.[...]

Thank you,

That worked great, and the mystery's solved. 

Many thanks,

-Jon Cyr

Robert Segall wrote:
[...]
>>>      
>>>[...][...]