I'm currently creating unique visit_id cookie in Apache with following code:

RewriteCond "%{HTTP_COOKIE}" "(^|;)\s*visit_id\s*=([A-Za-z0-9@-]+)" [NC]
RewriteRule ".?" - [CO=visit_id:%2:.www.mydomain.com:30,S=1]
RewriteRule ".?" - [CO=visit_id:%{ENV:UNIQUE_ID}:.www.mydomain.com:30]

(If cookie exists, refresh its expiration, else create cookie with value of UNIQUE_ID environment variable from mod_unique_id.)

This is working, but I would like to use more random-looking id, for example md5 of UNIQUE_ID. Is there a way to do this with just Apache configuration?

I tried %{md5:%{ENV:UNIQUE_ID}} but that doesn't work.

  • You should use session support from the language you are using behind apache. Do you use php, python, ruby? – Mircea Vutcovici Nov 2 '17 at 16:20
  • I want this cookie set also for files served directly with Apache, so I can't use php etc. – Markus Laire Nov 2 '17 at 16:21
  • 1
    What are you trying to accomplish? What is the main problem? – Mircea Vutcovici Nov 2 '17 at 20:26
  • @MirceaVutcovici I want to identify all access-log entries belonging to same "visit". While it's not a huge deal if someone tries to spoof UNIQUE_ID (which is quite easy), I would prefer ID to be something harder to spoof. – Markus Laire Nov 3 '17 at 10:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.