Question
Cloudflare Load Balancing Session Affinity Cookie Method v1.3.0 Attribute Compatibility Boundary
Ari Echo
0 reputation · 31 Jul 2023, 19:52 UTC
108.6K views1
Loading…
0 reputation · 31 Jul 2023, 19:52 UTC
Cloudflare Load Balancing introduced cookie-based Session Affinity in version 1.3.0, generating an edge-managed _cf_affinity cookie to route subsequent requests to the same origin. The documented behavior indicates that Cloudflare does not propagate SameSite or Secure attributes from the origin’s Set-Cookie header to this affinity cookie, and the Load Balancing settings do not currently expose controls for SameSite, Secure, or HttpOnly on the cookie itself.
This creates an unresolved compatibility boundary for applications that rely on strict cookie attribute enforcement at the edge. Because the affinity cookie is set by Cloudflare rather than the origin, the absence of configurable attributes may conflict with browser security expectations or organizational cookie policies. It remains unclear whether the current behavior is a permanent design constraint of the edge-managed cookie or a configuration gap that future versions will address, particularly when TLS termination occurs at the edge and origin headers differ from the final client-facing response.
Is the lack of configurable SameSite, Secure, and HttpOnly attributes on the _cf_affinity cookie an intentional limitation of the v1.3.0 Session Affinity implementation, or is support for edge-level cookie attribute configuration planned? How should teams evaluate whether their origin’s Set-Cookie headers influence the affinity cookie’s final attributes under different TLS termination modes? What is the current compatibility boundary between Cloudflare’s edge-managed affinity cookie and browser-enforced cookie attribute policies?
33775 reputation · 01 Aug 2023, 04:23 UTC
The lack of configurable SameSite, Secure, and HttpOnly attributes on the _cf_affinity cookie is a structural design of the Cloudflare Load Balancing implementation. Because this cookie is generated and managed exclusively at the edge to ensure routing consistency, it operates independently of the origin server's Set-Cookie headers.
It is confirmed that Cloudflare does not propagate security attributes from the origin's session cookies to the affinity cookie. The likely reason for this limitation is the separation of concerns: the affinity cookie is a routing mechanism for the edge infrastructure, whereas origin cookies are application-state mechanisms. Consequently, the edge-managed cookie follows a default set of attributes determined by the Cloudflare platform rather than the application's security policy.
Origin Set-Cookie headers have zero influence on the _cf_affinity cookie, regardless of the TLS termination mode (Flexible, Full, or Strict). Whether TLS is terminated at the edge or passed through to the origin, the edge-generated cookie is appended to the response after the origin has already processed the request.
To verify the current boundary for your specific environment, use the following verification steps:
cloudflareSet-Cookie: _cf_affinity=...._cf_affinity against your origin-generated session cookie (e.g., JSESSIONID or PHPSESSID).SameSite=Lax behavior is blocking the affinity cookie, which would result in a loss of session persistence.Teams must account for the following boundaries when aligning with organizational security policies:
HttpOnly or Secure for all cookies, the _cf_affinity cookie may trigger a compliance flag since it cannot be manually hardened via the dashboard.SameSite=Lax. If your application requires SameSite=Strict for the affinity cookie to function in specific cross-site contexts, the current edge implementation will not support this requirement.Diagnostic Requirement: Please specify if you are using Cloudflare Workers to modify response headers, as this is the only current method to potentially intercept and append attributes to edge-generated cookies.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.