0

Apache 2.4, using mod_session{,_dbd,_crypto}.
Something (SessionDBDCookieName?) adds Set-Cookie to most/all responses.

I can Header (always) unset in LocationMatch, to remove Set-Cookie on anything but / :

  <LocationMatch "^/.+">
    Header        unset "Set-Cookie"
    Header always unset "Set-Cookie"
  </LocationMatch>

But can't for the life of me unset Set-Cookie header on non-200 responses.
Set-Cookie header does not get removed whether inside any Location(Match) or out, whether Late mode or Early.
Tried stuff with mod_rewrite, SetEnvIf, Header merge/edit/set/unset - all without success.
Still need session checking on sub-paths, just can't send Set-Cookie on anything but /, so I can't just put SessionDBDCookieName in select LocationMatch blocks.
Only thing I can think of is proxying Apache through itself to force the removal of this header, but not ideal ...

How can I unset the Set-Cookie added by mod_session(_dbd?) on 3xx, 4xx, etc. ?

0

You must log in to answer this question.

Browse other questions tagged .