stateful session cookie additional attributes

[vestemeanv]

Title: Cannot set additional cookie attributes for stateful session cookies

Description:
There should be a way to set additional attributes for self generated cookies (#27529).
Trying to set those with LUA also fails as this does not see self-generated stateful session cookie since there's a variety of browsers that look at for example SameSite

Repro steps:
Just the LUA repro below. Further I could not find a way to set the cookie attributes for the stateful session.

 > .cookies; curl -Ik -c .cookies -b .cookies -H "Host: instance2.local" --resolve instance2.local:10002:127.0.0.1 https://instance2.local:10002/webaddr 
HTTP/1.1 200 OK
set-cookie: JSESSIONID=9997; Path=/; HttpOnly
date: Sun, 27 Oct 2024 23:10:01 GMT
content-length: 21
content-type: text/plain; charset=utf-8
x-envoy-upstream-service-time: 0
set-cookie: sticky_cookie="Cg4xMjcuMC4wLjE6OTk5Nw=="; Path=/; HttpOnly
server: envoy

The LUA script logs only the below cookie. It does not look like it has access to sticky_cookie

[2024-10-27 23:10:01.008][13][info][lua] [source/extensions/filters/http/lua/lua_filter.cc:946] script log: JSESSIONID=9997; Path=/; HttpOnly

LUA script:

function envoy_on_response(response_handle)
  response_handle:logInfo(response_handle:headers():get("Set-Cookie"))
end 

Also the config below did not set the Secure flag for the cookie

    response_headers_to_add:
    - header:
         key: "set-cookie"
         value: "%RESP(set-cookie)%; Secure"
      append_action: OVERWRITE_IF_EXISTS

Attached the config for /stats, /clusters and /server_info and /config_dump

[vestemeanv]

envoy.tar.gz
Attachment

[vestemeanv]

I can't find a way to set cookie attributes into the statueful session cookie
If there is a way to set the cookie attributes could you please help me understand how to do that.
Thanks

[nezdolik]

cc @wbpcode @cpakulski

[wbpcode]

I can't find a way to set cookie attributes into the statueful session cookie If there is a way to set the cookie attributes could you please help me understand how to do that. Thanks

The cookie_attributes is not supported in the stateful session cookie (I changed this issue as a feature requirement). And I think you can alos change it by lua filter if your lua filter is before stateful seesion filter in the http_filters list.

[rudrakhp]

The cookie_attributes is not supported in the stateful session cookie (I changed this issue as a feature requirement).

@wbpcode Is the ask here to support setting arbitrary cookie attributes in the statueful session cookie API?

And I think you can alos change it by lua filter if your lua filter is before stateful session filter in the http_filters list.

Does the stateful session filter append if there are existing cookie attributes?

[wbpcode]

@wbpcode Is the ask here to support setting arbitrary cookie attributes in the statueful session cookie API?

Yeah, but require some body has time. I basically could help to review or bug fix. But have no bandwidth for new feature. Or would you like to contribute? Modern c++ developing is not complex. 😃

Does the stateful session filter append if there are existing cookie attributes?

Because the set-cookie will be set when processing response. And when processing response, the excution order of http filter chain is reverse of the http_filters order.
If you lua filter is before of stateful session filter in the http_filters, then when processing response, lua filter will be exectuted after the stateful session, then you can change the set-cookie that added by the stateful session at lua filter.

[rudrakhp]

Yeah, but require some body has time. I basically could help to review or bug fix.

@wbpcode Sure I can take it up as my first 💯

And when processing response, the excution order of http filter chain is reverse of the http_filters order.

Makes sense 👍

[vestemeanv]

Thanks a lot for the help so far. I can confirm that moving the lua filter before the stateful session makes the stateful cookie available for the lua script.

[2024-10-30 12:57:00.688][10][info][lua] [source/extensions/filters/http/lua/lua_filter.cc:946] script log: JSESSIONID=9997; Path=/; HttpOnly,sticky_cookie="Cg4xMjcuMC4wLjE6OTk5Nw=="; Path=/; HttpOnly

[geraldstanje]

hi @vestemeanv can you show a demo sample?