Application hosted on Avi load balancer is not loading correctly

Products

• VMware Avi Load Balancer

Issue/Introduction

The Virtual service hosted on Avi is not loading correctly. 

Application users may experience issues while accessing the application. For an instance, certain dashboard is not loading, while rest of the application works fine. 

Cause

The root cause of the issue lies within the "Secure-HTTP" profile settings. Specifically, the "HTTP-only cookies" flag under security options in the Secure-HTTP profile may cause interference with the application’s functionality.

The HttpOnly attribute is a security feature that can be applied to cookies in web applications. When a cookie is marked with the HttpOnly flag, it instructs the browser to make the cookie inaccessible to client-side scripts (such as JavaScript). It can cause issues or limitations on the client side, especially in complex web apps or integrations.

When enabled, this flag forces the addition of the "HTTPOnly" attribute to cookies, which can prevent the application from working properly as older libraries or frameworks might assume cookie access is available and break if HTTP-only cookies is applied.

 

Resolution

To resolve the issue, disable the "HTTP-only cookies" flag in the Secure-HTTP profile within the Avi load balancer settings. This action prevents Avi from adding the "HTTPOnly" attribute to cookies, which is required by the application for proper functionality. 

Steps to resolve the issue:

1. Navigate to the Templates > Profiles > Application configuration on the Avi Controller.

2. Locate the Secure-HTTP profile in use by the problematic virtual service and edit it.

3. In the Security section, find the HTTP-only cookies flag.

4. Disable the HTTP-only cookies flag.

5. Save the changes and test the application.