I have a cookie that I need to be read in Javascript, so I need to remove the httponly part of the cookie from it.

This is the cookie I need to modify:

Set-Cookie: wordpress_c3d46b752402579c18e981091b8c940c=admin%7C1463963639%7CWsIehTVJh4%7C7ee6e8117b6b; expires=Mon, 23-May-2016 12:33:59 GMT; Max-Age=1252800; path=/wp-content/plugins; domain=.example.org; HttpOnly

I just need to strip the HttpOnly string at the end of the cookie

PS: I know that I'm introducing a potential security problem here.

  • 1
    Good luck with this! – gf_ May 9 '16 at 0:09
  • 1
    Be more specific about your needs - show an example cookie as an http header perhaps. You might be able to do something with the headers_more module and regular expressions, maybe but I wouldn't put money on it being possible. – Tim May 9 '16 at 0:32
  • 1
    I wonder if you can use more_set_headers with the value being a regular expression based on the value of the existing header. You could probably start experimenting with this. You'll have to build Nginx to include the headers_more module, which is quite easy photographerstechsupport.com/tutorials/… – Tim May 9 '16 at 0:58
  • 1
    Nope, sorry, I haven't tried it. It's just the only way I can come up with that might work. It's something you would have to follow up, try it out yourself and post the results. Maybe you need to use an intermediate variable, maybe you can do it directly, maybe it's not possible. – Tim May 9 '16 at 1:03
  • 1
    Configure your wordpress. But really, you must not want this. – Alexey Ten May 9 '16 at 7:03

There are Nginx Lua modules and code snippets that can do this, for example:

https://github.com/cloudflare/lua-resty-cookie

First grab the cookie:

syntax: cookie_val, err = cookie_obj:get(cookie_name)

You can then set it with httponly false:

syntax: ok, err = cookie_obj:set({
    key = "Name",
    value = "Bob",
    path = "/",
    domain = "example.com",
    secure = true, httponly = false,
    expires = "Wed, 09 Jun 2021 10:18:14 GMT",
    max_age = 50,
    extension = "a4334aebaec"
})
up vote 0 down vote accepted

This is possible using Lua:

nginx.conf:

location /foo {
    internal;
    #Do normal stuff that you will do in this location
}

location /bar {
    content_by_lua_block {
        response = ngx.location.capture("/foo")
        for cookieName, cookie in pairs(response.header["Set-Cookie"]) do
            #Modify cookie as needed
        end
    }
}

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.