Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [cookie]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
23 views

Nginx if cookie exists, use proxy, if not, run php to create cookie and check again

I'm trying to create a condition with nginx that if a cookie does not exists, the nginx run index.php to create the cookie, and if a cookie exists, then the nginx goes to proxy. How I can do this? I'm ...
user avatar
0 votes
0 answers
28 views

Web Server not responding to specific PHPSESSID

Language: PHP DB: MYSQL Webserver: APACHE2 (= LAMP) I am assessing different Vulnerability Scanners by running them against Vulnerable Web Applications (XVWA for instance). The Problem is, that after ...
user avatar
0 votes
0 answers
25 views

Conditionally updating cookie expiry time in nginx to find the idle time

I'm trying to implement a solution to identify if there was an idle time of X minutes between two requests. For this, I'm planning to use the following approach. Initially, set a cookie from the ...
user avatar
  • 101
1 vote
0 answers
959 views

How can I get HAProxy to override / standardise the assignment of a cookie across multiple backends?

I am running HAProxy version 2.0.12 2019/12/21 - It hosts multiple backends. In the web layer, I have a persistent cookie which just contains a GUID and is meant to be super-long lived (50 years, but ...
user avatar
  • 111
0 votes
1 answer
272 views

Openresty cookies whitelist when using proxy_pass

I'm setting up an openresty reverse proxy that will dispatch traffic to one of 2 backends depending on the path. I would like certain cookies from backend1 not to be passed to backend2. How should I ...
user avatar
  • 11
0 votes
0 answers
167 views

cross domain cookie with openid connect

my app allows users to login with openid connect on a openid provider site in www.domain1.com/login, when the user(me in this case) directly calls that url i can see that the browser sees a ...
user avatar
1 vote
1 answer
4k views

setup SameSite=none value in Nginx webserver

I need to setup SameSite=none value in Nginx webserver In case of using Nginx as main webserver and non reverse proxy will the below configuration work? Inside server block location { ...
user avatar
  • 11
1 vote
1 answer
839 views

How to protect against session hijacking in Flask [closed]

So, i'm developing a Flask web-app and i wanted to test its security since i've implemented the following: SSL Cert with cookies being securely transmitted CSRF token to avoid CSRF attacks Cookie ...
user avatar
2 votes
2 answers
1k views

PHP session timeout

I'm having some troubles with the session timeout in a PHP application, I suspect the timeout is given by code but I prefer checking the infrastructure first. The application I'm running is pure PHP 5....
user avatar
1 vote
1 answer
12k views

Apache reverse proxy - ProxyPassReverseCookieDomain not seeming to work

I can't seem to get the Apache directive ProxyPassReverseCookieDomain to actually rewrite the domain. My directive is set as such: ProxyPassReverseCookieDomain "myinternalproxydomain.com" "...
user avatar
  • 25
1 vote
1 answer
5k views

if not cookie set in nginx

I wanted to restrict access to our downloads section. If users/bots wants to download file without logging in they will see 403 error. Logic is wonderful but it turned out very ugly code location /...
user avatar
  • 195
7 votes
1 answer
3k views

Is it permissible for an intermediate proxy to add cookies during proxy authentication?

I recently encountered a certain security appliance (BlueCoat) which requires that all connections to the internet must be proxied through it (hello there, man-in-the-middle) and accordingly uses a ...
user avatar
  • 313
0 votes
1 answer
84 views

Two websites in different servers has same cookie_domain but is not sharing session [closed]

I have two different sites that has their own server. Site#2 sends request to Site#1 for logging customer in. Request contains Allow Crendentials Header and response is status 200. Both sites has same ...
user avatar
  • 9
1 vote
0 answers
417 views

I'm struggling to configure varnish to account for language cookie

I'm fairly new to the varnish cache world and I need to optimize a Wordpress application that is pretty slow. I made a lot of research today and I made some progress but I'm stuck with the ...
user avatar
  • 11
2 votes
1 answer
2k views

HTTP and cookies working with multiple severs

Assuming that a simplified diagram of an HTTP/1.1 connection in which the client makes a page and an image request with a cookie assignment can be reduced to this: (Time trasmission of the second ...
user avatar
1 vote
1 answer
4k views

How to use a hyphen in cookie names for nginx?

I want to use the new cookie-prefixes, which are not yet standardized by the IETF. These are __Secure- and __Host-. So let's e.g. set this cookie (here the header returned by the server): Set-Cookie: &...
user avatar
  • 436
1 vote
1 answer
366 views

Nginx: add domain into cookie

There is a directive in nginx - proxy_cookie_domain which allows to REPLACE the domain. But my problem is how to ADD the domain substring into the proxied cookies? The backend unfortunately doesn't ...
user avatar
0 votes
1 answer
220 views

User Getting Logged out in IE when closing browser

I am running a Drupal 7 site and am noticing a problem on IE9, when the browser window is closed the user is logged out. We have "remember me" module enabled and the cookie is set to not expire. There ...
user avatar
  • 51
1 vote
0 answers
1k views

php session tracking cookies (multiple session handling on same domain)

I have 2 applications, both have password based login, database,etc., the passwords are different, databases are different, applications present are in different folders. Log into the first ...
user avatar
  • 121
0 votes
0 answers
990 views

secure cookie in Apache => php session resets on every page load

I have set secure cookie in Apache based on this tutorial. But php session resets on every page load. for example this sample code: <?php session_start(); echo session_id(); ?> displays ...
user avatar
  • 147
0 votes
0 answers
1k views

HotSpot: Session Failed after Login with Phone Embedded Browsers

Some phones have their embedded browser when they are connecting to HotSpot. (For example in iPhone (iOS) or Windows Phone 8.1). The problem is after login into these browsers (with embedded browser),...
user avatar
  • 103
0 votes
1 answer
1k views

how to use varnish cache with set-cookie named mp3list and phpsessionid

I am new to php and i am interested to use varnish to improve site performance. I installed the latest version of varnish: 4.0.2 varnish HTTP/1.1 200 OK Date: Sat, 06 Dec 2014 07:24:47 GMT Server: ...
user avatar
5 votes
1 answer
39k views

HttpOnly and secure cookies with Apache mod_header for all cookies

I'm using Apache 2.2.29 for a website. The apache works both to serve pages from Drupal, and as reverse proxy to an internal application server. For security reasons we want to add the flags HttpOnly ...
user avatar
0 votes
1 answer
2k views

Varnish not caching because of language cookie, how to correct behaviour?

I am using Varnish 4 + Pagespeed on Nginx successfully, but varnish is not hitting the cache because the site always pushes a language cookie, disregarding if user is authenticated or not. That ...
user avatar
2 votes
1 answer
2k views

Setting up Nginx -- redirecting requests to a auth server and getting redirected back to serve the request

Any incoming request on (x.x.x.x.x)--> redirect to x.x.x.x.auth.domain.edu -- > that authenticates a user and redirects back to x.x.x.x server. (With a cookie set, In my case it is EZproxy server ...
user avatar
  • 121
1 vote
1 answer
3k views

IIS not sending ASP.Net cookies to IE10 (and only to IE10)

I have IIS 7.5 server running ASP.Net application, which for some reason doesn't send ASP.Net authentication cookies to IE10. This happens only when request comes in from IE10 browser and only over ...
user avatar
  • 143
0 votes
1 answer
2k views

htaccess redirect based on cookies

I need a welcome page for new visits. If a user don0t have the cookie stored, he will be redirected to welcome page. If the cookie is stored, nothing happens. Header set Set-Cookie "visited=true" ...
user avatar
  • 31
1 vote
2 answers
69 views

Multiple A record and session/cookie

For example I setup multiple a record for a domain abc.com 115.11.22.33 115.11.22.34 115.11.22.35 Is it true that if one browser successfully establishes a connection to one of the ip's, it ...
user avatar
0 votes
1 answer
3k views

secure cookies when https is done on balancer, but balancer->appserver is http

We're trying to maintain PCI compliance for our application and after an audit, the report was telling us that we need to set the secure flag on our cookies. The site is HTTPS (using pound for https ...
user avatar
-1 votes
1 answer
251 views

WebSphere and updating cookie information

After updating cookie information (name and path) on all my Application Servers in WebSphere and recycling the cluster, the application stopped working correctly and wouldn't allow people to log in. ...
user avatar
  • 103
3 votes
1 answer
26k views

Remove cookies by cookie name in nginx reverse proxy

I am fairly new to nginx and I am trying to set it up as a reverse proxy server. So far I have apache working as a backend server on 8080 and nginx on port 80. My website uses a lot of cookies which ...
user avatar
4 votes
1 answer
2k views

Changing a Set-Cookie header using mod_rewrite/mod_proxy

I have a bunch of CGI scripts, which are served using HTTPS. They can only be reached on the intranet, not from the outside. They set a cookie with the attribute 'Secure', so that it can only be send ...
user avatar
  • 191
5 votes
1 answer
3k views

How to not redirect when cookie is set in haproxy?

On my site I redirect users with mobile devices to a mobile site using my Haproxy loadbalancer. I got some complaints about that and want to offer the users a link back to the "classic" portal. As not ...
user avatar
0 votes
2 answers
10k views

Cookie not send in IE, when used in an IFrame from another domain

IE 8 and 9 does not send the cookie on the next request. It works in Chrome 14 and FF 6. In my case I've got an ASP.NET 3.5 web app running that uses cookies for authentication. If the cookie is not ...
user avatar
  • 141
3 votes
3 answers
5k views

Carrying cookies across redirects when using Apache as a reverse proxy

I'm attempting to setup a reverse proxy using Apache on my local machine, I have the following in my httpd.conf: ProxyPass /app http://x.com ProxyPassReverse /app http://x.com Everything works great ...
user avatar
  • 133
1 vote
1 answer
9k views

Nagios + check_http with header data

With cURL, I can successfully log into the website I want have Nagios test by passing --cookies. Something like this: curl --cookie "user=4reqrerqwr;userlogin=123adsfjlk324" http://mysite.com/home/...
user avatar
1 vote
1 answer
175 views

trac: keep trac_auth cookie after web browser closes

Is there a way to set how long the trac_auth cookie should live, so that I may stay logged in even after closing the web browser? From what I can see now, it is set to be deleted at browser exit. I ...
user avatar
  • 11
15 votes
4 answers
39k views

Controlling Nginx proxy target using a cookie?

I'm trying to convert a reverse proxy using an interesting Apache mod_rewrite setup to use Nginx instead (due to external concerns we are moving from Apache to Nginx, and most everything works fine ...
user avatar
  • 2,480
1 vote
1 answer
334 views

How to enable/disable mod_deflate based on a cookie?

I would like to enable mod_deflate based on the presence and value of a certain cookie. I know it’s possible to do cookie manipulation and tests with mod_rewrite, but I’m not sure how to do that kind ...
user avatar
3 votes
1 answer
2k views

In an IIS Log what does "..." mean in a "cs(Cookie)" column?

I've checked MSDN, and the W3C format, but nothing seems to explain what causes IIS to output "..." in the "cs(Cookie)" column. My assumption is that the cookie is "too big", but I'd like to know for ...
user avatar
1 vote
2 answers
2k views

Curl receives expired cookies

Why does curl receive an expired cookie? In a response to some url the server is sending a 302 Found response and a cookie. In Firefox this cookie gets set seamlessly. Firebug says: Set-Cookie ...
user avatar
  • 2,247
19 votes
2 answers
20k views

What is a cookie-free domain?

What is a cookie-free domain? I've seen these words many times but I never understood what it is.
user avatar