Symptoms
An APM session is invalidated when accessing the /public folder URLs on modifying session cookie information. If the modified LastMRHSession cookie collides with an existing session but the full MRHSession does not, then APM kills the closest matching session when accessing /public URLs.
Impact
Session is invalidated and new session is created.
Conditions
This issue occurs under the following conditions: 1. Configure an APM virtual server with a simple policy (any policy will suffice).
2. Configure an LTM virtual server that calls the APM virtual server with the iRule command: virtual.
3. Access the virtual server and get the APM session established.
4. Use the Cookies acquired to send a request for any resource in the /public folder on the BIG-IP system, but modify the MRHSession cookie so that it is slightly different from the correct value.
5. Observe that APM kills the session identified by the LastMRHSession cookie.
Workaround
The following iRule can be used to remove the cookie to prevent the issue:
when HTTP_REQUEST {
if {[HTTP::path] contains "/public"} {
HTTP::cookie remove "LastMRH_Session"
HTTP::cookie remove "MRHSession"
}
}
