Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cookies]

The tag has no usage guidance.

1
vote
1answer
53 views

Nginx preventing cookie from being sent from front to back end

I'm running a Golang back end on port 12345 and an Angular front end on port 8080. They communicate via websockets on a page called /consultation. When I open the firewall for both ports and have them ...
1
vote
1answer
4k views

Nginx proxy cookies not set

Here's my situation, I have a Rails 4 app that can be accessed by multiple domains, depending on the domain, the content changes. Say the main domain is domain1 and all the other domains just use ...
8
votes
2answers
65 views

How cookies work with non persistance load balencers

We have a Drupal application that uses sso to log users in. We are using AWS classic load balancers (ELB), AWS is telling us that there is no session persistence on the ELB. What I am trying to ...
0
votes
0answers
51 views

Force HaProxy to use same sticky session cookie across subdomains

I have a site with multiple subdomains. example.com img.example.com etc. They all point to the same HaProxy load balancer, which uses sticky sessions. Behind the load balancer, I have a number of ...
0
votes
0answers
38 views

How can I edit a cookie response from an upstream server to a client via an nginx proxy?

I have nginx listening on localhost set up to proxy requests to localhost:5000 to an upstream server. I want to edit cookie responses from the upstream server before nginx passes them to the client. I ...
0
votes
0answers
292 views

AWS Lambda: Using CORS & Lambda proxy to expose cloudfront signed cookies

I'm building a full javascript app from Salesforce.com API with no server side script that will be hosted on salesforce.com domain (https) This app should be able to grant access to multiple files ...
0
votes
1answer
55 views

Cookies present in the Chrome inspector are missing on the server

I have a setup comprised by 2 nginx instances connected one after the other. The first one is on one server (A) and the second one is on a second server (B): user <-> nginx (A) <-> nginx (...
0
votes
0answers
996 views

Cookie Does Not Contain The secure and HTTPOnly Attribute

While running a Qualys Vulnerability Scan on a website which is being developed I got the following vulnerability: Cookie Does Not Contain The "HTTPOnly" Attribute Cookie Does Not Contain The "...
0
votes
1answer
1k views

Configuring multiple ProxyPassReverseCookiePath in Apache HTTP

I have a server with an Apache reverse proxy in front. The server machine contains 2 web applications running under: localhost:8000/app and exposed as my.url.com/app1 localhost:8001/app and exposed ...
0
votes
0answers
20 views

Can I duplicate a cookie to another path under the same domain?

I'm hiding an application that's deployed at http://www.example.com/theapp and uses paths like http://www.example.com/theapp/public and http://www.example.com/theapp/registration, behind new path http:...
0
votes
0answers
135 views

Blocking Google Feud

I'm trying to block Google Feud on a Firewall/Proxy (Transparent Mode), but it seems a difficult task to accomplish.. I have some configurations for this task: ACL rules, blocking the access to the ...
0
votes
0answers
497 views

How to preserve cookie in HAProxy?

We currently have a the following setup: [Client] -> [haproxy] -> [Nginx] -> [App Servers] Nginx currently sets the cookie affinity to the app servers by setting a cookie i.e: public-client....
1
vote
1answer
754 views

extract query string param value in RewriteRule

I'm writing an apache 2.4 Rewrite rule in order to remove a query string param and create a cookie from its value. eg: http://example.com/?param1=value1&my_param=my_value&param2=value2 to ...
0
votes
2answers
132 views

Transform Apache Cookie logs to json with rsyslogd

I am logging cookie headers, some cookies may have due date, some others not, the same is tru for other cookie parameters, I need to implement a centrilaized logging, so before sending those to ...
0
votes
0answers
965 views

Cookies aren't being set/overwritten through nginx reverse proxy

For some reason, when I'm proxying my API request through an nginx reverse proxy, my cookies aren't being overwritten with the new values. I've tried adding the following to my nginx config, but I'm ...
0
votes
0answers
195 views

Website access control via HTTP_REFER and COOKIE

I've made a webform on my own domain, outside the domain of my company. The form is made for employees of the company. When an employee wants to get to the form he has to login to the company website ...
1
vote
1answer
5k views

What is the difference between http_cookie and cookie_name in Nginx?

I want to add remote ip as a Cookie in Nginx, so that it can be passed on to AWS Load Balancer for Load balancer stickiness. location / { proxy_set_header Cookie "$http_cookie; ip=$remote_addr"; ...
0
votes
0answers
655 views

Apache on Windows, Cookie w/ PHP Sessions Bug

At work we use a Win7 box to run our site. I know not really an appropriate server OS, but it was working just fine until we upgraded to PHP 7.1 and Apache 2.4 from PHP 5.2 and Apache 2.2. Now ...
1
vote
1answer
2k views

Information about securing cookies with path attribute with respect to ASP.NET and IIS

I need help with securing cookies for my web application. It's deployed in IIS and is built in ASP.NET MVC. These are the things that I need to get more information about Is the Sites folder in IIS ...
3
votes
1answer
771 views

Nginx reverse proxy - remove “Secure” from cookies

For the sake of development I need to make NGINX drop "Secure" flag from cookie headers. Set-Cookie:XSRF-TOKEN=zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzz; Path=/; Secure should become Set-Cookie:XSRF-TOKEN=...
0
votes
1answer
3k views

Add samesite to cookies using Nginx as reverse proxy

With Nginx as reverse proxy, how do you add samesite=strict or samesite=lax to cookies?
0
votes
0answers
1k views

NGINX stripping domain in Set-Cookie header

Problem: domains are stripped from the set-cookie header. httpoonly, expires, and path are all correct. My location block: location ~* ^/path { proxy_pass http://nodeserver; # this is an upstream ...
0
votes
0answers
360 views

Delete cookies from specific domain

I've been asked if it's possible to delete cookies in IE from specific domains via GPO? I've googled around and I'm sure this is possible but haven't been able to find anything about deleting cookies ...
0
votes
1answer
692 views

Failed to using powershell to get cookies

I am writing a powershell script to mimic a login process,and then catch data from web pages. I failed at the very begainning, I can't get into the login pages at all after I set up cookies. Here is ...
1
vote
0answers
1k views

400 bad request on nginx proxy to tomcat but not on static content

We have been running into an issue when our cookies reach a certain size (over 7k) where nginx is returning 400 Bad Request with an empty response when proxying to our tomcat. This doesn't happen when ...
0
votes
2answers
5k views

Varnish cache responese with “Set-Cookie” header

I have a page which sends a "Set-Cookie" header for something like the language depending on the URL. The thing is this page will get a fairly high hit rate but it's not an option right now to strip ...
1
vote
1answer
1k views

stickysession not work fine in apache and two Glassfish Instances

I have two application that run in two Glassfish Instances, i configure my apache to use sticky session like so : ProxyPass / balancer://Appcluster/ stickysession=JSESSIONID But this not work 100% ...
1
vote
1answer
883 views

How does the zScaler cookie authentication work?

I'm implementing a web filter for my organization and I'm considering zScaler. I do not want to use proxy PAC file. I just got off the phone with zScaler's sales and they claim that they can ...
1
vote
0answers
1k views

pass cookie from http response via nginx reverse proxy

I have a problem with passing my cookie when I'm running an nginx as a proxy (in a docker container). Here is my configuration of my nginx proxy: location /test { proxy_pass http://...
0
votes
1answer
464 views

Modsecurity cookie match [closed]

I run a small webhosting service (CPanel + ModSecurity) and I personnaly host few laravel projects on it. I noticed that when I (or anyone) visit multiple pages quickly (one after the other), at some ...
1
vote
0answers
32 views

Server can't parse cookie

I noticed the following messages in my TJWS log. [Mon Oct 03 21:28:28 EDT 2016] TJWS: An exception in parsing cookies: id=die(pi());; user=assert java.lang.IllegalArgumentException: Cookie name "; ...
0
votes
0answers
235 views

Resolving duplicate cookie error log messages in Apache 2.4

Running Apache 2.4.7, our error logs are cluttered with messages like: [core:error] ... AH00011: ap_cookie: client submitted cookie 'PHPSESSID' more than once: ... We haven't been able to determine ...
0
votes
1answer
13k views

Set “Secure Flag” on Cookies for Only One (of many) Virtual Host on Apache

I'm hosting a number of sites on a single VPS (Debian Jessie, Apache 2.4). One of these sites forces HTTPS. On this and only this site, I would like to set the "Secure Flag" for cookies. I've found ...
2
votes
0answers
606 views

Cookie Secure Flag not persistent

I'm trying to implement a Secure flag for all cookies. I'm doing this via Headers. Here's how I did it: Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4" It ...
0
votes
0answers
796 views

Adding CSRF token in to Cookies of Post request in Haproxy

My post request to UAA is missing CSRF value i.e. X-Uaa-Csrf=2QytIy. This is required for login in to cloud foundry UAA. This is problem is because of internet domain name /private domain name mapping ...
0
votes
1answer
41 views

Serve media content only to logged in user using Apache

I recently saw this feature on another site where it would server media files, like uploaded images, only when the user is logged in. It would throw an "ACCESS DENIED" page otherwise. So, I ...
1
vote
0answers
289 views

Reverse Proxy Nginx but cookies don't get through for WP admin

I reverse proxy a blog. It's hosted on Apache under a subdomain blog.example.com. In Nginx I have the following config in a server block. Everthing works except the cookies for the WP Admin panel ...
1
vote
1answer
3k views

SecureCookies, HTTPOnly cookies, .Net, and SSL offloading

So I've been looking into implementing HttpOnly and SecureCookies in my web environment. I have an F5 as the load balancer and a couple of C# web applications hosted in iis 7.5 for the website. The ....
0
votes
0answers
683 views

Backreferencing a cookie value in rewriterule

I'm trying to backreference a cookie's value in a RewriteRule : # Trace rewrite rules log LogLevel alert rewrite:trace4 # Rewriting the URL, in the cookie's condition i've tried en alone, and en|fl|...
1
vote
1answer
2k views

modsecurity whitelisting certian types of cookies

I am seeing cookies being generated on our server which appear to be from 3rd party objects in the site and don't show themselves when one logs in or navigates through the site. The cookies are ...
3
votes
0answers
989 views

CloudFront + S3 Access Denied Using Signed Cookies

I'm trying to integrate signed cookies for a CloudFront distribution that's fed off of an S3 bucket but getting access denied error messages: <Error> <Code>AccessDenied</Code> ...
0
votes
1answer
136 views

phpinfo showing HTTP_ALLOWCOOKIES set to NO - how to change?

We have a dev and live server that were seemingly built identically. However the live server phpinfo() page shows the following in the "Apache Environment" section HTTP_ALLOWCOOKIES NO Don't see ...
0
votes
0answers
313 views

What can cause cookies to arrive empty to the server?

We experience an issue where in IIS advanced logs we see that the requests arrive with SOME of the cookie values missing. Of course the values are missing in the application layer as well. This is ...
12
votes
3answers
20k views

haproxy: how to prepare a server maintenance without kicking app sessions?

The issue I'm using haproxy to load balance web servers. I use session persistence with additional cookies as some applications use session files and these are not synchronized between servers. I ...
0
votes
1answer
3k views

NGINX cache based on cookies

Is there a way for NGINX to have a different cache depending on the value of a cookie? In my case, I have a website (in my case, a plugin) that creates a cookie called devicePixelRatio. This is 1 in ...
0
votes
1answer
1k views

How to make nginx understand dots in cookie values?

I have Nginx configured as a simple sticky LB. One of the key parts of config is matching cookie value to server address. This works fine: map $cookie_sessionServer $http_sticky_backend { default ...
0
votes
1answer
3k views

Reverse Proxy a Sub-directory to a Sub-directory with Apache

I understand proxies in concept (though have never set one up). I'm attempting to proxy Drupal, but I'm fairly sure that my problem is not related to Drupal. As I have been trying to determine the ...
0
votes
2answers
930 views

HAproxy current session is zero

I have some problems on sticky sessions with HAproxy. Haproxy counts every request as a new session. I have a Java servlet that creates the cookie JSESSIONID. If I refresh that page 5 times. The ...
0
votes
1answer
713 views

Https on HAproxy 1.4 using stunnel

I'm running a load balancing server with HAproxy and implementing Https using stunnel on the same machine, on the actual webpages end i've got 2 diferent webs, A and B, with similar behaviour. Here ...
1
vote
1answer
1k views

IIS7 Multiple Websites Same Port

I am trying to set up an internal-only web server of our production websites for QA and development testing. There is no need or intention to access this dev site from outside of the corporate network....