Load balanced application does not work with a Firefox browser when persistence is set as CookieInsert.

Background

A customer was load balancing a web-based ERP application and when persistence was set to CookieInsert, the application did not work correctly and failed to render reports.

The application worked fine when the persistence was set to SourceIP. However, the application was not load balanced because the source IP addresses were translated.

Internet Explorer worked with no issues. In a non-working trace, NSC cookie was not visible. After further review, it was observed that load balancing parameter Persistence Cookie HTTPOnly Flag option was enabled by default. This setting has different behavior for different web browsers with regards to cookie persistence to protect the site against Cross-Site Scripting issues.

To resolve this issue, complete the following steps:

1. To disable the Persistence Cookie HTTPOnly Flag option, select Traffic Management > Load Balancing > Configure Load Balancing parameters, as shown in the following screen shot.

   

   Note: The preceding screen shot is taken using NetScaler software release 10.1.

2. To disable this option from the command line interface, run the following command:

   set lb parameter HttpOnlyCookieFlag disabled

   

Problem Cause

In the HTTP cookie, the appliance by default sets HTTPOnly Flag. The Persistence Cookie HTTPOnly Flag option is enabled and bound at a global level for load balancing parameters.

Certain browsers do not support HTTPOnly Flag. Therefore, it might not return the cookie and persistence is broken. For browsers that do not support this flag, you must disable HTTPOnly Flag in the persistence cookie. In this scenario, the customer site is internal. Therefore, based on the site or http server you are accessing, you can disable HTTPOnly Flag for the application to work on Firefox browser if it is not a security concern.