I have a cookie that I need to be read in Javascript, so I need to remove the httponly part of the cookie from it.

This is the cookie I need to modify:

Set-Cookie: wordpress_c3d46b752402579c18e981091b8c940c=admin%7C1463963639%7CWsIehTVJh4%7C7ee6e8117b6b; expires=Mon, 23-May-2016 12:33:59 GMT; Max-Age=1252800; path=/wp-content/plugins; domain=.example.org; HttpOnly

I just need to strip the HttpOnly string at the end of the cookie

PS: I know that I'm introducing a potential security problem here.

  • 1
    Good luck with this! – gf_ May 9 '16 at 0:09
  • 1
    Be more specific about your needs - show an example cookie as an http header perhaps. You might be able to do something with the headers_more module and regular expressions, maybe but I wouldn't put money on it being possible. – Tim May 9 '16 at 0:32
  • 1
    I wonder if you can use more_set_headers with the value being a regular expression based on the value of the existing header. You could probably start experimenting with this. You'll have to build Nginx to include the headers_more module, which is quite easy photographerstechsupport.com/tutorials/… – Tim May 9 '16 at 0:58
  • 1
    Nope, sorry, I haven't tried it. It's just the only way I can come up with that might work. It's something you would have to follow up, try it out yourself and post the results. Maybe you need to use an intermediate variable, maybe you can do it directly, maybe it's not possible. – Tim May 9 '16 at 1:03
  • 1
    Configure your wordpress. But really, you must not want this. – Alexey Ten May 9 '16 at 7:03

There are Nginx Lua modules and code snippets that can do this, for example:


First grab the cookie:

syntax: cookie_val, err = cookie_obj:get(cookie_name)

You can then set it with httponly false:

syntax: ok, err = cookie_obj:set({
    key = "Name",
    value = "Bob",
    path = "/",
    domain = "example.com",
    secure = true, httponly = false,
    expires = "Wed, 09 Jun 2021 10:18:14 GMT",
    max_age = 50,
    extension = "a4334aebaec"

This is possible using Lua:


location /foo {
    #Do normal stuff that you will do in this location

location /bar {
    content_by_lua_block {
        response = ngx.location.capture("/foo")
        for cookieName, cookie in pairs(response.header["Set-Cookie"]) do
            #Modify cookie as needed

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.