Cookie rule | HCL Digital Experience

You can use cookie rules to determine how you want the cookie to be handled.

The following options are available:

The cookie can be made visible for the client that calls the outbound HTTP connection.
The cookie can be wrapped in another cookie.
The cookie can be stored in either of the following types of cookie store:
- A cookie store that is scoped for the session
- A cookie store that is scoped for the request

To configure your cookie rules, use the following attributes:

cookie

This attribute is required. You can specify multiple cookie attributes. cookie attributes contain a wildcard expression of a cookie name for which this cookie rule applies.

scope

This attribute is optional. The scope attribute denotes the scope for which the cookie is shared. The following scope values are valid:

user: This value is the default value. It defines that the cookie is scoped to the user that receives the cookie from the remote server.
system: This value defines the cookie as shared. That means that all clients of an outbound connection that establish a connection use the same cookie.
application: This value determines that the cookie is scoped to the application from which the outbound connection is established.

handling

This attribute is optional. It determines how to proceed with cookies that are defined by the remote server in outbound HTTP connections: The following handling values are valid:

passthru: This value is the default value. It leaves the cookie unchanged. The cookie is returned to the user of the outbound HTTP connection. It is up to the caller of the outbound HTTP connection to handle this cookie.
wrap: This value wraps this cookie in another cookie. If you specify this value, the transformation rules define the characteristics of this transformation.
block: This value blocks this cookie. If the cookie is set by the caller of the outbound HTTP connection, the cookie is not sent to the remote host. In the same manner, cookies that are set by the remote system are not received at the outbound HTTP connection.
store-in-request: This value stores the cookie in a cookie store during the HTTP request. Cookies that are set by the remote host are filtered out by the cookie handling filter. When the next HTTP connections are made, the stored cookies are added to the request header of this request.
store-in-session: This value stores the cookie in a cookie store during the HTTP session. Cookies that are set by the remote host are filtered out by the cookie handling filter. When the next HTTP connections are made, the stored cookies are added to the request header of this request.

The following example shows a cookie rule that contains a cookie rule for LTPA tokens, an application cookie that is named app_cookie, and a further cookie that is named another_cookie. By these cookie rules, the LTPA token is saved in a cookie store, and the two cookies app_cookie and another_cookie are passed through the proxy to the client.

<proxy-rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:noNamespaceSchemaLocation="http://www.ibm.com/xmlns/prod/sw/http/outbound/proxy-config/2.0">
     <policy name="SamplePolicy" url="http://www.myremotehost.com/*">
          <actions><method>GET</method></actions>
          <cookie-rule name="my_sso_tokens">
               <cookie>LtpaToken*</cookie>
               <handling>store-in-session</handling>
          </cookie-rule>
          <cookie-rule name="my_application_cookies">
               <cookie>app_cookie</cookie>
               <cookie>another_cookie</cookie>
               <handling>passthru</handling>
          </cookie-rule>
     </policy>
</proxy-rules>