Apache 2.4, using mod_session{,_dbd,_crypto}.
Something (SessionDBDCookieName?) adds Set-Cookie to most/all responses.
I can Header (always) unset
in LocationMatch, to remove Set-Cookie on anything but / :
<LocationMatch "^/.+">
Header unset "Set-Cookie"
Header always unset "Set-Cookie"
</LocationMatch>
But can't for the life of me unset Set-Cookie header on non-200 responses.
Set-Cookie header does not get removed whether inside any Location(Match) or out, whether Late mode or Early.
Tried stuff with mod_rewrite, SetEnvIf, Header merge/edit/set/unset - all without success.
Still need session checking on sub-paths, just can't send Set-Cookie on anything but /, so I can't just put SessionDBDCookieName in select LocationMatch blocks.
Only thing I can think of is proxying Apache through itself to force the removal of this header, but not ideal ...
How can I unset the Set-Cookie added by mod_session(_dbd?) on 3xx, 4xx, etc. ?