I have a bunch of cgi scripts, which are served using HTTPS. They can only be reached on the intranet, not from the outside. They set a cookie with the attribute 'Secure', so that it can only be send via HTTPS. There is also a reverse proxy to one of these scripts, unfortunately using plain HTTP. When a response comes in from my cgi-script with a secure cookie, it is not being passed on via HTTP (after all, that is what that attribute is for). I need however, an exception to this rule.
Is it possible to use
mod_proxy or something similar, to change the
set-cookie header in the response coming from my cgi script and remove the
Secure, such that the cookie can be passed back to the user using the unsafe HTTP connection? I understand that this defeats the purpose of the
Secure in the first place, but I need this as a temporary work around.
I have searched the web and found how to add a
set-cookie header using
mod_rewrite, and I have also found how to retrieve the value of a cookie coming from the client in a
cookie header. What I have not yet found is how to extract the
set-cookie header received in the response of a script I am proxying for. Is that possible? How would I do that?