> Source: [sk116063](https://support.checkpoint.com/results/sk/sk116063)

# sk116063 - "Please enable cookies in your browser" error when connecting to Citrix StoreFront through Mobile Access gateway

| Property | Value |
|----------|-------|
| Solution ID | sk116063 |
| Date Created | 2017-02-27 |
| Last Modified | 2025-01-13 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * "`Please enable cookies in your browser`" error in web browser instead of the login page when connecting to Citrix StoreFront through Mobile Access gateway.

* Connecting to the same Citrix StoreFront without Mobile Access gateway works correctly.

## Cause

When the connection between the Mobile Access gateway and the Citrix StoreFront server is over HTTP (not HTTPS),  
the web application falsely detects that cookies are disabled in the web browser. As a result, the login page does not load.

This happens because the JavaScript on the client-side sees the connection between the client and the Mobile Access gateway as HTTPS,  
which causes the client to set the "secure" attribute on its cookies, which means they should not be forwarded over HTTP.  
The Mobile Access gateway indeed does not pass these cookies over HTTP.

This causes the JavaScript on the client-side to test whether cookies are enabled in the web browser:  
the first cookie that is sent is a test cookie - the test fails, and the above error is presented to the user in the web browser.

There is a Path Translation rule in the *$CVPNDIR/conf/includes/CustomRulesBefore.conf* file on the Mobile Access gateway  
to translate *window.location.protocol* to the protocol used with the backend server.  
However, in Citrix StoreFront JavaScript, the "*CTXS.Location = windows.location* " is used.  
This causes the existing Path Translation rule to miss the *CTXS.Location.protocol*.

## Solution

This problem was fixed. The fix is included starting from:

* [Check Point R80.20](https://support.checkpoint.com/results/sk/sk122485)

Check Point recommends to always upgrade to the [Recommended version](https://support.checkpoint.com/results/sk/sk95746) ([Security Management Server](https://support.checkpoint.com/product/184)).

If you choose not to upgrade, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for your version.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

<br />

If you do not wish to install the hotfix, the following manual **workaround** is available:

**Note:** In cluster environment, this procedure must be performed on *all* members of the cluster.

1. Connect to the command line on Mobile Access gateway.

2. Log in to the Expert mode.

3. Backup the current *$CVPNDIR/conf/includes/CustomRulesBefore.conf* file:

   **`[Expert@HostName:0]# cp -v $CVPNDIR/conf/includes/CustomRulesBefore.conf $CVPNDIR/conf/includes/CustomRulesBefore.conf_ORIGINAL`**
4. Edit the current *$CVPNDIR/conf/includes/CustomRulesBefore.conf* file:

   **`[Expert@HostName:0]# vi $CVPNDIR/conf/includes/CustomRulesBefore.conf`**
5. Add the following Path Translation rule for the JavaScript to see the protocol that is used internally and act accordingly (lines in blue color):

   ` # For window.location.<att> in JS (when reading or comparing)`  
   ` SubstituteCond %{ENV:CvpnResourceType} !=INOTES`  
   ` SubstituteCond %{ENV:FOUND_location} =1`  
   ` Substitute s~([^$_a-zA-Z0-9.\s]\s*)((?:(?:window|self)\.)?(?:document\.)?location)\.(hostname|host|pathname|protocol|port)(\b\s*(?:[^=\s]|[!=]==?))~$1__CVPN_PT_GET_ORIG_$3__($2.pathname)$4~kq`  
   ` `  
   ` ` # For CTXS.Location.<att> in Storefront JS (when reading or comparing)  
   SubstituteCond %{ENV:CvpnResourceType} =CITRIX  
   Substitute s~([^$_a-zA-Z0-9.\s]\s*)(CTXS\.Location)\.(hostname|host|pathname|protocol|port)(\b\s*(?:[^=\s]|[!=]==?))~$1__CVPN_PT_GET_ORIG_$3__($2.pathname)$4~kq ` `  

   ` # For XXX.location assignment in JS`  
   ` ... ...`  
   ` ... ... `
6. Save the changes and exit from Vi editor.

7. Reload the Mobile Access policy:

   **Note:** This will disconnect all connected users.
   **`[Expert@HostName:0]# cvpnd_admin policy`**

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content