2

I use Apache 2.2.16 as Reverse Proxy. For a static website, I don't have any issues. However, when began to use cookies, I've noticed that the browser is receiving a different cookie than what was sent by the backend server. I confirmed this with Wireshark.

Here's a snippet of my config:

<VirtualHost *:80>
    ServerName  app.somewhere.com:80
    ServerAlias app

    ProxyRequests Off
    ProxyPreserveHost On

    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>

    ProxyPass /app http://10.x.x.x/app
    ProxyPassReverse /app http://10.x.x.x/app

    <Location />
        Order allow,deny
        Allow from all
    </Location>
</VirtualHost>

But when I try to access the app server directly, I receive the cookies ok.

Is this an expected behaviour for Apache2? I'm using HAProxy for another application that sends cookies to the client and I get all of them.

5
  • Can you confirm that the backend server is sending the correct cookies to the proxy? Apache won't manipulate a response header unless you tell it to. Sep 5, 2012 at 6:27
  • Yes, at least from the application, the cookies are being sent out. I used Wireshark to confirm this. And when I access the backend server directly, it also gives the browser the cookies. FYI these are session cookies. However, when apache is in the middle, I get a different cookie. Could apache possibly manages these cookies and sends client another identifier; so as to hide the actual cookies from the browser? Sep 5, 2012 at 8:06
  • By the way, I have a near-default config for apache and I don't have any header rewriting whatsoever, not yet. I'm suspecting that apache is proxying the session either by design or a default configuration and may be changed. I'll check the traffic being passed to-from apache to pinpoint where the cookie is being "lost". I'll run a quick tcpdump. Sep 5, 2012 at 8:15
  • What cookie do you get instead of the expected session cookie? Apache doesn't send cookies on its own, and has no concept of sessions (except when reading another application's cookies for load balancer session persistence). Sep 5, 2012 at 15:52
  • I found the issue and it's not because of Apache. The cookie is not being "shared" because of a mismatch of cookie domain and the domain mapped to Apache. Our Oracle app needed to be configured to use the same domain as in the Apache. Thanks @ShaneMadden for clarifying my (incorrect) assumptions. Sep 10, 2012 at 7:15

0

You must log in to answer this question.

Browse other questions tagged .