Changing Cookie Domains

Question

I use apache as a proxy to my application web server and would like to on the fly, change the domain name associated with a sessionid cookie.

The cookie has a .company.com domain associated with it, and I would like using apache mod rewrite (or some similar module), transparently change the domain to app.company.com. Is this possible ? and if so, how would one go about it ?

Answer 1

You can only change the domain of a cookie on the client, or when it's being set on the server. Once a cookie has been set, the path and domain information for it only exists on the client. So existing cookies can't have their domain changed on the server, because that information isn't sent from the client to the server.

For example, if you have a cookie that looks like this on your local machine:

MYCOOKIE:123, domain:www.test.com, path:/

Your server will only receive:

MYCOOKIE:123 

on the server. Why isn't the path and domain sent? Because the browser keeps that information on the client, and doesnt bother sending it along, since it only sends this cookie to your server if the page is at www.test.com and at the path /.

Since it's your server, you should be able to change your code that creates new cookies. If you felt you needed to do it outside of your code for some reason, you could do so with something like the following, but you'd have to look exactly at how your cookie is being written in the header to match it exactly. The following is an untested guess at a workable solution for this, using Apache's mod_headers:

<IfModule mod_headers.c>
  Header edit Set-Cookie (.*)(domain=.company.com;)(.*) $1 domain=app.company.com; $2
</IfModule>

You can also use mod_headers to change the cookie received from the client, like so, if need be:

<IfModule mod_headers.c>
  RequestHeader edit Cookie "OLD_COOKIE=([0-9a-zA-Z\-]*);" "NEW_COOKIE_NAME=$1;"
</IfModule>

This would only rename cookies you receive in the request.

Answer 2

ProxyPassReverseCookieDomain company.com app.company.com

or interchanging domains (as you are not clearly defining which is internal/external).

ref: https://httpd.apache.org/docs/2.4/en/mod/mod_proxy.html#ProxyPassReverseCookieDomain