Can Azure Application gateway cookie be replaced by application cookie?

Question

I have a VMSS with multiple instances that have a java application deployed in it. The VMSS is connected to an application gateway. The gateway have session affinity enabled.

Is it possible to override or tell gateway to use cookie created by java application?

The reason why I need that is because, when a request comes to application gateway with multiple params, the processing is done by java application. This processing creates a unique ID record where the user is redirected to.

When this redirection request reaches to application gateway, the gateway sends the request to another server where unique ID is not present, as a result, error is thrown.

My Idea: When the request comes to gateway and reaches to java program, I create a cookie with some information. The cookie is sent back and when the request is redirected, I use the same cookie to identify the server.

Is this possible?

Can I use an application cookie and tell application gateway to use that cookie to identify the server?

Answer 1

This might be possible to tell the gateway to use application created cookie with rewriting HTTP headers.

Taken from rewriting HTTP headers with Application Gateway. The HTTP header rewrite support is only available for the Standard_V2 and WAF_v2 SKU.

Application Gateway supports several server variables that help you store additional information about requests and responses. You can rewrite all headers in requests and responses, except for the Host, Connection, and Upgrade headers. You can also use the application gateway to create custom headers and add them to the requests and responses being routed through it.

However, there are some limitations:

If a response has more than one headers with the same name, then rewriting the value of one of those headers will result in dropping the other headers in the response. This can usually happen with Set-Cookie header since you can have more than one Set-Cookie header in a response. One such scenario is when you are using an app service with an application gateway and have configured cookie-based session affinity on the application gateway. In this case the response will contain 2 Set-Cookie headers: one used by the app service, i.e., Set-Cookie: ARRAffinity=ba127f1caf6ac822b2347cc18bba0364d699ca1ad44d20e0ec01ea80cda2a735;Path=/;HttpOnly;Domain=sitename.azurewebsites.net and another for application gateway affinity, i.e., Set-Cookie: ApplicationGatewayAffinity=c1a2bd51lfd396387f96bl9cc3d2c516; Path=/. Rewriting one of the Set-Cookie headers in this scenario can result in removing the other Set-Cookie header from the response.

Per my understanding, you can rewrite one of the set-cookie headers to keep the Set-Cookie header the same.