I have a bunch of CGI scripts, which are served using HTTPS. They can only be reached on the intranet, not from the outside. They set a cookie with the attribute 'Secure', so that it can only be send via HTTPS. There is also a reverse proxy to one of these scripts, unfortunately using plain HTTP. When a response comes in from my CGI-script with a secure cookie, it is not being passed on via HTTP (after all, that is what that attribute is for). I need however, an exception to this rule.
Is it possible to use
mod_proxy or something similar, to change the
Set-Cookie header in the response coming from my CGI script and remove the
Secure, such that the cookie can be passed back to the user using the unsafe HTTP connection? I understand that this defeats the purpose of the
Secure in the first place, but I need this as a temporary work around.
I have searched the web and found how to add a
Set-Cookie header using
mod_rewrite, and I have also found how to retrieve the value of a cookie coming from the client in a
cookie header. What I have not yet found is how to extract the
Set-Cookie header received in the response of a script I am proxying for. Is that possible? How would I do that?