On Wed, Oct 28, 2020 at 12:00:01PM +0000, squid-users-request@xxxxxxxxxxxxxxxxxxxxx wrote: > Date: Thu, 29 Oct 2020 00:08:34 +1300 > From: Amos Jeffries <squid3@xxxxxxxxxxxxx> > To: squid-users@xxxxxxxxxxxxxxxxxxxxx > Subject: Re: Reverse proxying Exchange OWA wembail with SSL > offloading - not working on IE/Chrome > > On 28/10/20 5:25 pm, Scott wrote: > > > > Here are the logs (first not working, followed by working). > > > > Note this is the login attempt, not the loading of the initial page. You'll > > see in the NOT WORKING section that the browser does NOT return a cookie to > > the server, which is where the problem may be. Again, I'm not sure why - I'm > > thinking perhaps the browser/javascript is rejecting the cookie as it's > > missing the "secure" attribute (because the back-end is talking plain HTTP). > > > > The complete absence of a cookie may be expected to break something. > > The absence of a "secure" flag should only make the cookie vulnerable to > leaking. It should not affect anything depending on that cookies value. > > > Amos > My current theory is that the browser ignores the server-supplied cookie because it is missing the "secure" flag. I could be completely wrong of course. But that flag is one of the few differences between a working session and a not-working session. I did find this site: https://support.kemptechnologies.com/hc/en-us/articles/202154165-How-to-Add-an-SSL-Secure-and-HTTP-only-flag-to-cookies-from-a-Real-Server that is in the same ball park of my suspicions. I've tried building an ICAP server using the examples from PyICAP and have got as far as receiving the data and altering the header but I can't work out how to send the modified header and data back to Squid. My code is: def cookie_RESPMOD(self): self.set_icap_response(200) self.set_enc_status(b' '.join(self.enc_res_status)) for h in self.enc_res_headers: for v in self.enc_res_headers[h]: if h == "set-cookie" and re.search(r'HttpOnly', v) and not re.search(r'secure', v): v = v.replace('; HttpOnly', '; secure; HttpOnly') print("h: ", h, "v: ", v) self.set_enc_header(h, v) if not self.has_body: self.send_headers(False) return self.send_headers(True) return I'm sure it's something simple like not sending the body. I really need to read the ICAP docs/RFCs. The script generates the following: 10.2.255.1 - - [28/Oct/2020 23:17:21] "OPTIONS icap://10.2.255.1:40000/cookie ICAP/1.0" 200 - 10.2.255.1 - - [28/Oct/2020 23:17:21] "RESPMOD icap://10.2.255.1:40000/cookie ICAP/1.0" 200 - 10.2.255.1 - - [28/Oct/2020 23:17:21] code 400, message B 10.2.255.1 - - [28/Oct/2020 23:17:31] "RESPMOD icap://10.2.255.1:40000/cookie ICAP/1.0" 200 - 10.2.255.1 - - [28/Oct/2020 23:17:31] code 400, message B 10.2.255.1 - - [28/Oct/2020 23:17:31] "RESPMOD icap://10.2.255.1:40000/cookie ICAP/1.0" 200 - 10.2.255.1 - - [28/Oct/2020 23:17:31] code 400, message B I might look into a code hack as a means of testing. _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
