4

Trying to replace Apache by Nginx as a web proxy in front of some Tomcat servers, dealing with Set-Cookie JSESSIONID is proving to be challenging. Our Tomcat content is served with Cache-Control and Set-Cookie.

In Apache we can cache based purely on the Cache-Control by using the CacheIgnoreHeaders Set-Cookie... and here is the important part: the cached content is served without Set-Cookie so we're avoiding session leaks. But in Nginx, proxy_ignore_headers Set-Cookie will fallback to Cache-Control to decide if a page should be cached... but the cached content is then served with that JSESSIONID.

Adding proxy_hide_header Set-Cookie removes the JSESSIONID from all served content, cached or not, meaning the whole site becomes stateless.

2
  • Ideally you should only have a session ID when there's an actual need for it (user logs in, user adds to cart, etc). – Michael Hampton Jul 2 '15 at 15:45
  • 1
    May be you need proxy_cache_bypass $cookie_jsessionid;? – Alexey Ten Jul 2 '15 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.