How to use the Signed Cookies integration through Azion Marketplace

1. Access Azion Console > Marketplace.
2. On the Marketplace homepage, look for the Signed Cookies integration.

• You can search any integration by browsing through the cards, using the filters, or typing a keyword in the search bar.

3. Once you’ve found the Signed Cookies - Hash Generator and Signed Cookies - Hash Validator cards, select one to go to the integration’s page.
4. On the integration’s page, click the Install button.

A message appears indicating that your integration was successfully installed.

Then, follow the same steps to install the second integration.

1. Access Real-Time Manager (RTM) > Marketplace.
2. On the Marketplace homepage, look for the Signed Cookies integration.

• You can search any integration by browsing through the cards, using the filters, or typing a keyword in the search bar.

3. Once you’ve found the Signed Cookies - Hash Generator and Signed Cookies - Hash Validator cards, select one to go to the integration’s page.
4. On the integration’s page, click the Get It Now button to install it.

A message appears indicating that your integration was successfully installed.

Then, follow the same steps to install the second integration.

1. On the upper-left corner, select Products menu > Edge Application on the Build section.
2. On the listing page of your edge applications, select the one you want to use with the Signed Cookies integration.
3. On the Main Settings tab, under Modules, locate the Edge Functions switch and turn it on to enable Functions on your edge application.
4. Still under the Modules section, locate the Application Accelerator switch and turn it on to enable the Forward Cookies functionality for your application.

• This will be addressed later at the Rules Engine section.

4. Click the Save button.

You’ll receive a success message indicating that your edge application has been updated.

1. On the upper-left corner, select Products menu > Edge Application on the BUILD section.
2. On the listing page of your edge applications, select the one you want to use with the Signed Cookies integration.
3. On the Main Settings tab, under Modules, locate the Edge Functions switch and turn it on to enable Functions on your edge application.
4. Still under the Modules section, locate the Application Accelerator switch and turn it on to enable the Forward Cookies functionality for your application.

• This will be addressed later at the Rules Engine section.

4. Click the Save button.

You’ll receive a success message indicating that your edge application has been updated.

1. Select the Functions tab on the top list.
2. Click the Add Function button.
3. Choose an easy to remember name for your function.
4. On the dropdown function menu, select the Signed Cookies function.

This action will load the function, showing a form with the function’s source code and, just above it, two tabs: Code and Args. By clicking the Code tab you will be able to navigate through the code but won’t be able to change it.

For the Hash Generator, the parameters are:

{
  "cookie_list": ["yummy_cookie", "tasty_cookie"],
  "cookie_secret": "ItIsASecret",
  "tampering_cookie_prefix": "tampering_protection"
}

Where:

• cookie_list: defines the list of cookies that should be protected. For each cookie in this list, an encrypted version of the cookie will be appended to the response.
• cookie_secret: defines a secret to protect the encrypted cookie against client-side manipulation.
• tampering_cookie_prefix: defines the prefix to be used in the name of the encrypted cookies.

You should pay attention to the possible values added to the tampering_cookie_prefix.

For example, if the value of this argument is tampering_protection and the cookies are yummy_cookie and tasty_cookie, the encrypted cookies created by the function will be named tampering_protection_yummy_cookie and tampering_protection_tasty_cookie.

If this argument doesn’t have a valid value, then the default value azion_tampering is used. Therefore, in this case, the encrypted cookies would be azion_tampering_yummy_cookie and azion_tampering_tasty_cookie.

For the Hash Validator, the parameters are:

{
  "cookie_list": ["yummy_cookie", "tasty_cookie"],
  "cookie_secret": "ItIsASecret",
  "tampering_cookie_prefix": "tampering_protection",
  "tampering_violation_header_prefix": "azion-tampering-violation"
}

These are the same fields of the Signed Cookies - Hash Generator, with the addition of one more field, tampering_violation_header_prefix. It defines a prefix to the headers which the function will append to the request whenever a cookie violation is identified.

You should pay attention to the possible values added to tampering_violation_header_prefix.

For example, the Cookie-Violation-Any, Cookie-Violation-Counter, and Cookie-Violation-List headers will be created if the value of this argument is Cookie-Violation.

If this argument doesn’t have valid data, the defaults are Azion-Tampering-Violation-Any, Azion-Tampering-Violation-Counter, and Azion-Tampering-Violation-List.

1. Select the Functions Instances tab on the top list.
2. Click the + Function Instance button.
3. Choose an easy to remember name for your function.
4. On the dropdown function menu, select the Signed Cookies function.

• This action will load the Arguments tab.

For the Hash Generator, the parameters are:

{
  "cookie_list": ["yummy_cookie", "tasty_cookie"],
  "cookie_secret": "ItIsASecret",
  "tampering_cookie_prefix": "tampering_protection"
}

Where:

• cookie_list: defines the list of cookies that should be protected. For each cookie in this list, an encrypted version of the cookie will be appended to the response.
• cookie_secret: defines a secret to protect the encrypted cookie against client-side manipulation.
• tampering_cookie_prefix: defines the prefix to be used in the name of the encrypted cookies.

You should pay attention to the possible values added to the tampering_cookie_prefix.

For example, if the value of this argument is tampering_protection and the cookies are yummy_cookie and tasty_cookie, the encrypted cookies created by the function will be named tampering_protection_yummy_cookie and tampering_protection_tasty_cookie.

If this argument doesn’t have a valid value, then the default value azion_tampering is used. Therefore, in this case, the encrypted cookies would be azion_tampering_yummy_cookie and azion_tampering_tasty_cookie.

For the Hash Validator, the parameters are:

{
  "cookie_list": ["yummy_cookie", "tasty_cookie"],
  "cookie_secret": "ItIsASecret",
  "tampering_cookie_prefix": "tampering_protection",
  "tampering_violation_header_prefix": "azion-tampering-violation"
}

These are the same fields of the Signed Cookies - Hash Generator, with the addition of one more field, tampering_violation_header_prefix. It defines a prefix to the headers which the function will append to the request whenever a cookie violation is identified.

You should pay attention to the possible values added to tampering_violation_header_prefix.

For example, the Cookie-Violation-Any, Cookie-Violation-Counter, and Cookie-Violation-List headers will be created if the value of this argument is Cookie-Violation.

If this argument doesn’t have valid data, the defaults are Azion-Tampering-Violation-Any, Azion-Tampering-Violation-Counter, and Azion-Tampering-Violation-List.

1. Select the Rules Engine tab.
2. Click the + Rule Engine button.
3. Give an easy to remember name to your rule.
4. Select Response Phase.
5. Pass the criteria you need to in order to run your integration.
6. On the behavior field, select Run Function from the dropdown menu.
7. Select the Signed Cookies - Hash Generator function, according to the name you gave it in the instantiation step.
8. Click the Save button.

Then, you have to configure the request phase for the Rules Engine.

Still in the Edge Application page, follow these steps:

1. Select the Rules Engine tab.
2. Click the + Rule button and
3. Give an easy to remember name to your rule.
4. Select Request Phase.
5. Pass the criteria you need to in order to run your integration.
6. On the behavior field, select Run Function from the dropdown menu.
7. Select the Signed Cookies - Hash Validator function, according to the name you gave it in the instantiation step.
   • You’ll also need a second behavior for the Signed Cookies - Hash Validator function: Forward Cookies.
8. To add it, click the + Add Behavior button and select the Forward Cookies option from the dropdown menu.
9. Click the Save button.

Done. You’ve successfully instantiated your two integrations and are now protected against attackers.

1. Select the Rules Engine tab.
2. Click the New Rule button and select Response Phase.
3. Give an easy to remember name to your rule.
4. Pass the criteria you need to in order to run your integration.
5. On the behavior field, select Run Function from the dropdown menu.
6. Select the Signed Cookies - Hash Generator function, according to the name you gave it in the instantiation step.
7. Click the Save button.

Then, you have to configure the request phase for the Rules Engine.

Still in the Edge Application page, follow these steps:

1. Select the Rules Engine tab.
2. Click the New Rule button and select Request Phase.
3. Give an easy to remember name to your rule.
4. Pass the criteria you need to in order to run your integration.
5. On the behavior field, select Run Function from the dropdown menu.
6. Select the Signed Cookies - Hash Validator function, according to the name you gave it in the instantiation step.
   • You’ll also need a second behavior for the Signed Cookies - Hash Validator function: Forward Cookies.
7. To add it, click the + button and select the Forward Cookies option from the dropdown menu.
8. Click the Save button.

Done. You’ve successfully instantiated your two integrations and are now protected against attackers.