# Using cookies for ACL

**URL:** <https://discourse.haproxy.org/t/using-cookies-for-acl/3875>\
**Category:** Help!\
**Created:** [May 29, 2019, 11:52am UTC](https://discourse.haproxy.org/t/using-cookies-for-acl/3875 "2019-05-29T11:52:16Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![wontbeherelong](https://avatars.discourse-cdn.com/v4/letter/w/779978/32.png) [@wontbeherelong](https://discourse.haproxy.org/u/wontbeherelong)\
**Post date:** [May 29, 2019, 11:52am UTC](https://discourse.haproxy.org/t/using-cookies-for-acl/3875/1 "2019-05-29T11:52:16Z")

</div>

First, apologies if I’m being a fool but am new to HAproxy. I’m using it in PFsense as a reverse proxy and want an ACL that checks for the presence of a cookie, and only forwards to the backend if it’s present.

After searching, I created the ACL in the frontend like so: “req.cook(organizrLanguage) -m found”

I did try to add has\_cookie but it threw an error when loading the config of "unknown fetch method ‘has\_cookie’ in ACL expression. Is that neede? If I use this ACL I only get a 503 error. What am I doing wrong? Eventually I want to replace that cookie with the value of a token, but if I can get this working I’ll have taken the first step.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 29, 2019, 10:08pm UTC](https://discourse.haproxy.org/t/using-cookies-for-acl/3875/2 "2019-05-29T22:08:38Z")

</div>

Try working with req.cook\_cnt and the returned counter:

```
req.cook_cnt(organizrLanguage) gt 0

```

Actually `gt 0` may not even be necessary, int 0 should be seen as false automatically.

---

<div class="post-metadata">

**Author:** ![wontbeherelong](https://avatars.discourse-cdn.com/v4/letter/w/779978/32.png) [@wontbeherelong](https://discourse.haproxy.org/u/wontbeherelong)\
**Post date:** [May 29, 2019, 10:59pm UTC](https://discourse.haproxy.org/t/using-cookies-for-acl/3875/3 "2019-05-29T22:59:08Z")

</div>

I’ve tried both options, but I’m still getting a 503. To be clear, I don’t need to define this further in actions too somehow do I? I’ve simply used eg.

> [@lukastribus](#):
>
> req.cook\_cnt(organizrLanguage) gt 0

and named it ACL12. So I only need to list ACL 12 as the condition ACL name? I’m at a loss as to why this doesn’t work.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 29, 2019, 11:10pm UTC](https://discourse.haproxy.org/t/using-cookies-for-acl/3875/4 "2019-05-29T23:10:38Z")

</div>

You need to share the complete configuration, I cannot possibly tell otherwise.

---

<div class="post-metadata">

**Author:** ![wontbeherelong](https://avatars.discourse-cdn.com/v4/letter/w/779978/32.png) [@wontbeherelong](https://discourse.haproxy.org/u/wontbeherelong)\
**Post date:** [May 30, 2019, 12:15am UTC](https://discourse.haproxy.org/t/using-cookies-for-acl/3875/5 "2019-05-30T00:15:37Z")

</div>

Apologies, I should have done that sooner. Here it is:

# Automaticaly generated, dont edit manually.

# Generated on: 2019-05-30 00:01

global  
maxconn 1000  
stats socket /tmp/haproxy.socket level admin  
gid 80  
nbproc 1  
hard-stop-after 15m  
chroot /tmp/haproxy\_chroot  
daemon  
tune.ssl.default-dh-param 2048  
log-send-hostname HaproxyMasterNode  
server-state-file /tmp/haproxy\_server\_state

listen HAProxyLocalStats  
bind 127.0.0.1:2200 name localstats  
mode http  
stats enable  
stats admin if TRUE  
stats show-legends  
stats uri /haproxy/haproxy\_stats.php?haproxystats=1  
timeout client 5000  
timeout connect 5000  
timeout server 5000

frontend http-to-https  
bind X.X.X.X:80 name X.X.X.X:80  
mode http  
log global  
option http-keep-alive  
timeout client 30000  
acl mydomain.co.uk-Redirect var(txn.txnhost) -m beg -i [mydomain.co.uk](http://mydomain.co.uk)  
acl [mydomain.co.uk](http://mydomain.co.uk) var(txn.txnhost) -m str -i [www.mydomain.co.uk](http://www.mydomain.co.uk)  
http-request set-var(txn.txnhost) hdr(host)  
http-request redirect scheme https

frontend shared-frontend-merged  
bind 62.30.18.212:443 name 62.30.18.212:443 no-sslv3 force-tlsv12 ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ssl crt-list /var/etc/haproxy/shared-frontend.crt\_list  
mode http  
log global  
option http-keep-alive  
option forwardfor  
acl https ssl\_fc  
http-request set-header X-Forwarded-Proto http if !https  
http-request set-header X-Forwarded-Proto https if https  
timeout client 30000  
acl ACL1 var(txn.txnhost) -m str -i [mydomain.co.uk](http://mydomain.co.uk)  
acl ACL2 var(txn.txnhost) -m str -i [mydomain.co.uk](http://mydomain.co.uk)

acl aclcrt\_shared-frontend var(txn.txnhost) -m reg -i ^www.mydomain.co.uk(:([0-9]){1,5})?$  
acl aclcrt\_shared-frontend var(txn.txnhost) -m reg -i ^mydomain.co.uk(:([0-9]){1,5})?$

acl aclcrt\_shared-frontend var(txn.txnhost) -m reg -i ^mysub.mydomain.co.uk(:([0-9]){1,5})?$

acl ACL6 var(txn.txnhost) -m str -i [mysub.mydomain.co.uk](http://mysub.mydomain.co.uk)

use\_backend MyBackendServer\_ipv4 if ACL6 ACL12

backend MyBackendServer

\_ipv4  
mode http  
id 10106  
log global  
timeout connect 30000  
timeout server 30000  
retries 3  
source ipv4@ usesrc clientip  
server MyServer 192.168.2.10:8080 id 10101 check inter 1000

> Blockquote

---

<div class="post-metadata">

**Author:** ![wontbeherelong](https://avatars.discourse-cdn.com/v4/letter/w/779978/32.png) [@wontbeherelong](https://discourse.haproxy.org/u/wontbeherelong)\
**Post date:** [May 30, 2019, 12:22am UTC](https://discourse.haproxy.org/t/using-cookies-for-acl/3875/6 "2019-05-30T00:22:49Z")

</div>

I can’t actually see any sign of the custom ACL12, only that it should be used. Yet here’s a screenshot of pfsense:

 ![Screenshot%20from%202019-05-30%2001-19-06](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/1X/3b25b41edf6227bd093b6b0a0a83164c9989cfef.png)

I appreciate the help. I’ve been loving HAproxy but I can’t understand why this doesn’t work.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [May 30, 2019, 8:05am UTC](https://discourse.haproxy.org/t/using-cookies-for-acl/3875/7 "2019-05-30T08:05:36Z")

</div>

I don’t know anything about this GUI. If the configuration you think you applied doesn’t show up in the actual configuration, I don’t know what to tell you. Talk to the pfsense guys.

Make sure the GUI is really only using a single configuration file, because it’s also possible to use multiple configuration files.