Trying to replace Apache by Nginx as a web proxy in front of some Tomcat servers, dealing with
Set-Cookie JSESSIONID is proving to be challenging.
Our Tomcat content is served with Cache-Control and Set-Cookie.
In Apache we can cache based purely on the Cache-Control by using the
CacheIgnoreHeaders Set-Cookie... and here is the important part: the cached content is served without Set-Cookie so we're avoiding session leaks.
But in Nginx,
proxy_ignore_headers Set-Cookie will fallback to
Cache-Control to decide if a page should be cached... but the cached content is then served with that JSESSIONID.
proxy_hide_header Set-Cookie removes the JSESSIONID from all served content, cached or not, meaning the whole site becomes stateless.