next up previous contents
Next: Format Up: Payload Detection Rule Options Previous: Examples   Contents


The http_raw_cookie keyword is a content modifier that restricts the search to the extracted UNNORMALIZED Cookie Header field of a HTTP client request or a HTTP server response (per the configuration of HttpInspect 2.2.6).

As this keyword is a modifier to the previous content keyword, there must be a content in the rule before http_raw_cookie is specified. This keyword is dependent on the enable_cookie config option. The Cookie Header field will be extracted only when this option is configured.


Eugene Misnik 2013-05-08