Questions tagged [cookie]
The cookie tag has no usage guidance.
41
questions
1
vote
1
answer
221
views
How do I add the __Secure prefix in this .htaccess line?
Sorry, I'm not an Apache expert.
I need to add the __Secure prefix to this htaccess line:
Header onsuccess edit Set-Cookie (.*) "$1; SameSite=Strict; Secure"
is this possible? How?
- 111
1
vote
1
answer
53
views
Clicking a Google query link logs user out of session
I have a curious situation with my NodeJS server: it seems like searching for the website on Google signs out the user.
The homepage is https://emocoes.org/pt/inicio. I sign in to the website and the ...
- 239
1
vote
0
answers
2k
views
How can I get HAProxy to override / standardise the assignment of a cookie across multiple backends?
I am running HAProxy version 2.0.12 2019/12/21 - It hosts multiple backends.
In the web layer, I have a persistent cookie which just contains a GUID and is meant to be super-long lived (50 years, but ...
- 111
0
votes
1
answer
605
views
Openresty cookies whitelist when using proxy_pass
I'm setting up an openresty reverse proxy that will dispatch traffic to one of 2 backends depending on the path.
I would like certain cookies from backend1 not to be passed to backend2.
How should I ...
- 11
0
votes
0
answers
343
views
cross domain cookie with openid connect
my app allows users to login with openid connect on a openid provider site in www.domain1.com/login, when the user(me in this case) directly calls that url i can see that the browser sees a ...
1
vote
1
answer
6k
views
setup SameSite=none value in Nginx webserver
I need to setup SameSite=none value in Nginx webserver
In case of using Nginx as main webserver and non reverse proxy will the below configuration work?
Inside server block
location {
...
- 11
1
vote
1
answer
1k
views
How to protect against session hijacking in Flask [closed]
So, i'm developing a Flask web-app and i wanted to test its security since i've implemented the following:
SSL Cert with cookies being securely transmitted
CSRF token to avoid CSRF attacks
Cookie ...
- 23
2
votes
2
answers
2k
views
PHP session timeout
I'm having some troubles with the session timeout in a PHP application, I suspect the timeout is given by code but I prefer checking the infrastructure first. The application I'm running is pure PHP 5....
- 53
2
votes
1
answer
16k
views
Apache reverse proxy - ProxyPassReverseCookieDomain not seeming to work
I can't seem to get the Apache directive ProxyPassReverseCookieDomain to actually rewrite the domain.
My directive is set as such:
ProxyPassReverseCookieDomain "myinternalproxydomain.com" "...
- 45
1
vote
1
answer
6k
views
if not cookie set in nginx
I wanted to restrict access to our downloads section. If users/bots wants to download file without logging in they will see 403 error. Logic is wonderful but it turned out very ugly code
location /...
- 195
7
votes
1
answer
3k
views
Is it permissible for an intermediate proxy to add cookies during proxy authentication?
I recently encountered a certain security appliance (BlueCoat) which requires that all connections to the internet must be proxied through it (hello there, man-in-the-middle) and accordingly uses a ...
- 323
0
votes
1
answer
141
views
Two websites in different servers has same cookie_domain but is not sharing session [closed]
I have two different sites that has their own server. Site#2 sends request to Site#1 for logging customer in. Request contains Allow Crendentials Header and response is status 200. Both sites has same ...
- 9
1
vote
0
answers
450
views
I'm struggling to configure varnish to account for language cookie
I'm fairly new to the varnish cache world and I need to optimize a Wordpress application that is pretty slow. I made a lot of research today and I made some progress but I'm stuck with the ...
- 11
2
votes
1
answer
2k
views
HTTP and cookies working with multiple severs
Assuming that a simplified diagram of an HTTP/1.1 connection in which the client makes a page and an image request with a cookie assignment can be reduced to this:
(Time trasmission of the second ...
- 23
1
vote
1
answer
4k
views
How to use a hyphen in cookie names for nginx?
I want to use the new cookie-prefixes, which are not yet standardized by the IETF. These are __Secure- and __Host-.
So let's e.g. set this cookie (here the header returned by the server):
Set-Cookie: &...
- 496
2
votes
1
answer
600
views
Nginx: add domain into cookie
There is a directive in nginx - proxy_cookie_domain which allows to REPLACE the domain. But my problem is how to ADD the domain substring into the proxied cookies? The backend unfortunately doesn't ...
0
votes
1
answer
220
views
User Getting Logged out in IE when closing browser
I am running a Drupal 7 site and am noticing a problem on IE9, when the browser window is closed the user is logged out. We have "remember me" module enabled and the cookie is set to not expire. There ...
- 51
1
vote
0
answers
1k
views
php session tracking cookies (multiple session handling on same domain)
I have 2 applications, both have password based login, database,etc., the passwords are different, databases are different, applications present are in different folders.
Log into the first ...
- 121
0
votes
0
answers
1k
views
secure cookie in Apache => php session resets on every page load
I have set secure cookie in Apache based on this tutorial.
But php session resets on every page load.
for example this sample code:
<?php
session_start();
echo session_id();
?>
displays ...
- 157
0
votes
0
answers
1k
views
HotSpot: Session Failed after Login with Phone Embedded Browsers
Some phones have their embedded browser when they are connecting to HotSpot. (For example in iPhone (iOS) or Windows Phone 8.1).
The problem is after login into these browsers (with embedded browser),...
- 103
1
vote
1
answer
1k
views
how to use varnish cache with set-cookie named mp3list and phpsessionid
I am new to php and i am interested to use varnish to improve site performance.
I installed the latest version of varnish: 4.0.2 varnish
HTTP/1.1 200 OK
Date: Sat, 06 Dec 2014 07:24:47 GMT
Server: ...
- 31
5
votes
1
answer
40k
views
HttpOnly and secure cookies with Apache mod_header for all cookies
I'm using Apache 2.2.29 for a website. The apache works both to serve pages from Drupal, and as reverse proxy to an internal application server. For security reasons we want to add the flags HttpOnly ...
0
votes
1
answer
2k
views
Varnish not caching because of language cookie, how to correct behaviour?
I am using Varnish 4 + Pagespeed on Nginx successfully, but varnish is not hitting the cache because the site always pushes a language cookie, disregarding if user is authenticated or not.
That ...
- 63
2
votes
1
answer
3k
views
Setting up Nginx -- redirecting requests to a auth server and getting redirected back to serve the request
Any incoming request on (x.x.x.x.x)--> redirect to x.x.x.x.auth.domain.edu -- > that authenticates a user and redirects back to x.x.x.x server. (With a cookie set, In my case it is EZproxy server ...
- 121
1
vote
1
answer
3k
views
IIS not sending ASP.Net cookies to IE10 (and only to IE10)
I have IIS 7.5 server running ASP.Net application, which for some reason doesn't send ASP.Net authentication cookies to IE10. This happens only when request comes in from IE10 browser and only over ...
- 143
0
votes
1
answer
2k
views
htaccess redirect based on cookies
I need a welcome page for new visits. If a user don0t have the cookie stored, he will be redirected to welcome page. If the cookie is stored, nothing happens.
Header set Set-Cookie "visited=true"
...
- 31
1
vote
2
answers
82
views
Multiple A record and session/cookie
For example I setup multiple a record for a domain
abc.com
115.11.22.33
115.11.22.34
115.11.22.35
Is it true that if one browser successfully establishes a connection to one of the ip's, it ...
- 145
0
votes
1
answer
3k
views
secure cookies when https is done on balancer, but balancer->appserver is http
We're trying to maintain PCI compliance for our application and after an audit, the report was telling us that we need to set the secure flag on our cookies. The site is HTTPS (using pound for https ...
- 103
-1
votes
1
answer
313
views
WebSphere and updating cookie information
After updating cookie information (name and path) on all my Application Servers in WebSphere and recycling the cluster, the application stopped working correctly and wouldn't allow people to log in.
...
- 103
3
votes
1
answer
27k
views
Remove cookies by cookie name in nginx reverse proxy
I am fairly new to nginx and I am trying to set it up as a reverse proxy server. So far I have apache working as a backend server on 8080 and nginx on port 80.
My website uses a lot of cookies which ...
- 373
4
votes
1
answer
3k
views
Changing a Set-Cookie header using mod_rewrite/mod_proxy
I have a bunch of CGI scripts, which are served using HTTPS. They can only be reached on the intranet, not from the outside. They set a cookie with the attribute 'Secure', so that it can only be send ...
- 191
5
votes
1
answer
3k
views
How to not redirect when cookie is set in haproxy?
On my site I redirect users with mobile devices to a mobile site using my Haproxy loadbalancer. I got some complaints about that and want to offer the users a link back to the "classic" portal. As not ...
- 71
0
votes
2
answers
10k
views
Cookie not send in IE, when used in an IFrame from another domain
IE 8 and 9 does not send the cookie on the next request. It works in Chrome 14 and FF 6.
In my case I've got an ASP.NET 3.5 web app running that uses cookies for authentication. If the cookie is not ...
- 141
3
votes
3
answers
5k
views
Carrying cookies across redirects when using Apache as a reverse proxy
I'm attempting to setup a reverse proxy using Apache on my local machine, I have the following in my httpd.conf:
ProxyPass /app http://x.com
ProxyPassReverse /app http://x.com
Everything works great ...
- 133
1
vote
1
answer
10k
views
Nagios + check_http with header data
With cURL, I can successfully log into the website I want have Nagios test by passing --cookies.
Something like this: curl --cookie "user=4reqrerqwr;userlogin=123adsfjlk324" http://mysite.com/home/...
- 670
1
vote
1
answer
188
views
trac: keep trac_auth cookie after web browser closes
Is there a way to set how long the trac_auth cookie should live, so that I may stay logged in even after closing the web browser? From what I can see now, it is set to be deleted at browser exit. I ...
- 11
15
votes
4
answers
43k
views
Controlling Nginx proxy target using a cookie?
I'm trying to convert a reverse proxy using an interesting Apache mod_rewrite setup to use Nginx instead (due to external concerns we are moving from Apache to Nginx, and most everything works fine ...
- 2,622
1
vote
1
answer
336
views
How to enable/disable mod_deflate based on a cookie?
I would like to enable mod_deflate based on the presence and value of a certain cookie.
I know it’s possible to do cookie manipulation and tests with mod_rewrite, but I’m not sure how to do that kind ...
- 716
3
votes
1
answer
2k
views
In an IIS Log what does "..." mean in a "cs(Cookie)" column?
I've checked MSDN, and the W3C format, but nothing seems to explain what causes IIS to output "..." in the "cs(Cookie)" column.
My assumption is that the cookie is "too big", but I'd like to know for ...
- 151
1
vote
2
answers
2k
views
Curl receives expired cookies
Why does curl receive an expired cookie?
In a response to some url the server is sending a 302 Found response and a cookie. In Firefox this cookie gets set seamlessly. Firebug says:
Set-Cookie ...
- 2,347
19
votes
2
answers
20k
views
What is a cookie-free domain?
What is a cookie-free domain? I've seen these words many times but I never understood what it is.
- 666