The Secure attribute might be missing from SAS session cookies in SAS^® 9.4M5 and later after you configure HTTPS  for SAS^® Web Server. This problem can occur in instances where the internal server's IP address for SAS Web Server is nonstandard, often due to the presence of a network device such as BigIP or F5.

By default, SAS 9.4M5 and later include the following <Valve> definition in the web-application server instances:

In order for the Secure attribute to be set, the SAS Web Server IP address must be matched by the regular expression that is defined by the internalProxies parameter. In rare instances, there is no match. In such an instance, you must customize the regular expression in order for the web-application server instance to match the incoming IP address. Rather than modifying the existing expressions, the recommended way to customize the expression is to add an additional expression to the end of the string, preceded by the "|" delimiter, which separates the expressions in the string. There are a number of regular-expression matching applications online that can aid in the customization.

Here is an example of customized syntax:

You must make the customization for all instances of web-application server SASServerX_Y. Then, you need to restart the services for the change to take effect.

Operating System and Release Information