I have a cookie that I need to be read in Javascript, so I need to remove the httponly part of the cookie from it.

This is the cookie I need to modify:

Set-Cookie: wordpress_c3d46b752402579c18e981091b8c940c=admin%7C1463963639%7CWsIehTVJh4%7C7ee6e8117b6b; expires=Mon, 23-May-2016 12:33:59 GMT; Max-Age=1252800; path=/wp-content/plugins; domain=.example.org; HttpOnly

I just need to strip the HttpOnly string at the end of the cookie

PS: I know that I'm introducing a potential security problem here.

  • 1
    Good luck with this!
    – gxx
    May 9, 2016 at 0:09
  • 1
    Be more specific about your needs - show an example cookie as an http header perhaps. You might be able to do something with the headers_more module and regular expressions, maybe but I wouldn't put money on it being possible.
    – Tim
    May 9, 2016 at 0:32
  • 1
    I wonder if you can use more_set_headers with the value being a regular expression based on the value of the existing header. You could probably start experimenting with this. You'll have to build Nginx to include the headers_more module, which is quite easy photographerstechsupport.com/tutorials/…
    – Tim
    May 9, 2016 at 0:58
  • 1
    Nope, sorry, I haven't tried it. It's just the only way I can come up with that might work. It's something you would have to follow up, try it out yourself and post the results. Maybe you need to use an intermediate variable, maybe you can do it directly, maybe it's not possible.
    – Tim
    May 9, 2016 at 1:03
  • 1
    Configure your wordpress. But really, you must not want this.
    – Alexey Ten
    May 9, 2016 at 7:03

2 Answers 2


There are Nginx Lua modules and code snippets that can do this, for example:


First grab the cookie:

syntax: cookie_val, err = cookie_obj:get(cookie_name)

You can then set it with httponly false:

syntax: ok, err = cookie_obj:set({
    key = "Name",
    value = "Bob",
    path = "/",
    domain = "example.com",
    secure = true, httponly = false,
    expires = "Wed, 09 Jun 2021 10:18:14 GMT",
    max_age = 50,
    extension = "a4334aebaec"

This is possible using Lua:


location /foo {
    #Do normal stuff that you will do in this location

location /bar {
    content_by_lua_block {
        response = ngx.location.capture("/foo")
        for cookieName, cookie in pairs(response.header["Set-Cookie"]) do
            #Modify cookie as needed

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .