2

We have an issue on our site with cookies growing too large. We have already expanded the acceptable header size and throttled the cookie sizes for now, but I'd like to figure out what the average client's header sizes are, specifically of the cookies.

I've created an apache log that captures the cookies being set on each request:

LogFormat "%{Cookie}i" cookies

But this just spits out the entire contents of all cookies in the header.

Is there a way to have apache just log the size (or just length of the string) per request?

1

AFAIK not :(

But what you can do instead of writing directly to a log file is to use Apaches ability to use a pipe and parse the apache log lines before writing them to file.

...
LogFormat "%{Cookie}i" cookies
CustomLog "| /usr/local/bin/cookiecutter.awk" cookies

A sample awk script might be the one below:

#! /bin/awk -f
# /usr/local/bin/cookiecutter.awk
{
   print length($0) >> "/var/log/apache/cookielength_log"
}

A couple of additional fields like for instance the browser identification string might be useful as well, use your imagination.

| improve this answer | |
1

Instead of logging the cookie size, you can log the content of cookies that are above some length. Note: This solution requires apache 2.4.

Let's say you want to log cookies above 8190 bytes (which is the default value for LimitRequestFieldSize), use this in httpd.conf

# Increase LimitRequestFieldSize so it'll let cookies above 8190 pass
LimitRequestFieldSize 12000

# Set an environment variable if the value of the Cookie header 
# matches a string with more than 8190 characters
SetEnvIfExpr "req('Cookie') =~ /^.{8190,}$/" COOKIE_ABOVE_LIMIT

# Define a log format that logs the cookie contents
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Host}i\" \"%{Referer}i\" \"%{User-Agent}i\" \"%{Cookie}i\" %{ms}T" log_cookie

# Create a conditional log rule that will log only if the 
# the environment variable is set
CustomLog "/var/log/httpd/cookie_above_limit_log" log_cookie env=COOKIE_ABOVE_LIMIT
| improve this answer | |
  • Can we check this for all header values? – Aryan Apr 10 '18 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.