Changing Cookie Domains

问题

I use apache as a proxy to my application web server and would like to on the fly, change the domain name associated with a sessionid cookie.

The cookie has a .company.com domain associated with it, and I would like using apache mod rewrite (or some similar module), transparently change the domain to app.company.com. Is this possible ? and if so, how would one go about it ?

回答1:

You can only change the domain of a cookie on the client, or when it's being set on the server. Once a cookie has been set, the path and domain information for it only exists on the client. So existing cookies can't have their domain changed on the server, because that information isn't sent from the client to the server.

For example, if you have a cookie that looks like this on your local machine:

MYCOOKIE:123, domain:www.test.com, path:/

Your server will only receive:

MYCOOKIE:123 

on the server. Why isn't the path and domain sent? Because the browser keeps that information on the client, and doesnt bother sending it along, since it only sends this cookie to your server if the page is at www.test.com and at the path /.

Since it's your server, you should be able to change your code that creates new cookies. If you felt you needed to do it outside of your code for some reason, you could do so with something like the following, but you'd have to look exactly at how your cookie is being written in the header to match it exactly. The following is an untested guess at a workable solution for this, using Apache's mod_headers:

<IfModule mod_headers.c>
  Header edit Set-Cookie (.*)(domain=.company.com;)(.*) $1 domain=app.company.com; $2
</IfModule>

You can also use mod_headers to change the cookie received from the client, like so, if need be:

<IfModule mod_headers.c>
  RequestHeader edit Cookie "OLD_COOKIE=([0-9a-zA-Z\-]*);" "NEW_COOKIE_NAME=$1;"
</IfModule>

This would only rename cookies you receive in the request.

回答2:

ProxyPassReverseCookieDomain company.com app.company.com

or interchanging domains (as you are not clearly defining which is internal/external).

ref: https://httpd.apache.org/docs/2.4/en/mod/mod_proxy.html#ProxyPassReverseCookieDomain

回答3:

I don’t know any module that provides such feature. So I guess you will need to write your own output filter using mod_ext_filter that does this for you.

But if you have control over the other server, it might suffice to just omit the cookie’s domain value so that the client will automatically choose the requested domain as the cookie’s domain.

回答4:

I ended up just creating an intermediate page that via javascript changed the cookie domain to the proxy server (by omitting the domain value) and then re-directed user to the target page. That seemed to resolve the issue. Thanks for your answers.

回答5:

If your web-app is capturing the Host: header and using that to determine the domain= portion of the cookie, you might also consider the Apache directive ProxyPreserveHost On which relays the Host: header from the client.

This only works if your app is designed to assume that its domain name is whatever the client suggests with the Host header. If your app is one of these, this will not only fix your cookies, but also any absolute URLs that the application generates, which can save you the overhead of otherwise needing to enable mod_substitute

来源：https://stackoverflow.com/questions/4923064/changing-cookie-domains