Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use Apache 2.2.16 as Reverse Proxy. For a static website, I don't have any issues. However, when began to use cookies, I've noticed that the browser is receiving a different cookie than what was sent by the backend server. I confirmed this with Wireshark.

Here's a snippet of my config:

<VirtualHost *:80>
    ServerAlias app

    ProxyRequests Off
    ProxyPreserveHost On

    <Proxy *>
        Order deny,allow
        Allow from all

    ProxyPass /app http://10.x.x.x/app
    ProxyPassReverse /app http://10.x.x.x/app

    <Location />
        Order allow,deny
        Allow from all

But when I try to access the app server directly, I receive the cookies ok.

Is this an expected behaviour for Apache2? I'm using HAProxy for another application that sends cookies to the client and I get all of them.

share|improve this question
Can you confirm that the backend server is sending the correct cookies to the proxy? Apache won't manipulate a response header unless you tell it to. – Shane Madden Sep 5 '12 at 6:27
Yes, at least from the application, the cookies are being sent out. I used Wireshark to confirm this. And when I access the backend server directly, it also gives the browser the cookies. FYI these are session cookies. However, when apache is in the middle, I get a different cookie. Could apache possibly manages these cookies and sends client another identifier; so as to hide the actual cookies from the browser? – Ianthe the Duke of Nukem Sep 5 '12 at 8:06
By the way, I have a near-default config for apache and I don't have any header rewriting whatsoever, not yet. I'm suspecting that apache is proxying the session either by design or a default configuration and may be changed. I'll check the traffic being passed to-from apache to pinpoint where the cookie is being "lost". I'll run a quick tcpdump. – Ianthe the Duke of Nukem Sep 5 '12 at 8:15
What cookie do you get instead of the expected session cookie? Apache doesn't send cookies on its own, and has no concept of sessions (except when reading another application's cookies for load balancer session persistence). – Shane Madden Sep 5 '12 at 15:52
I found the issue and it's not because of Apache. The cookie is not being "shared" because of a mismatch of cookie domain and the domain mapped to Apache. Our Oracle app needed to be configured to use the same domain as in the Apache. Thanks @ShaneMadden for clarifying my (incorrect) assumptions. – Ianthe the Duke of Nukem Sep 10 '12 at 7:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.