Apache mod_header rule to change all cookies to secure

apache-2.2cookies

I would like to change all cookies to be secure and http-only. It works fine for one cookie, but doesn't work when multiple cookies are set in response.

Apache mod_header rule should change cookies from:


Set-Cookie cookie1=value; Path=/somePath
Set-Cookie cookie2=value; Path=/somePath

to


Set-Cookie cookie1=value; Path=/somePath; Secure; Http-Only
Set-Cookie cookie2=value; Path=/somePath; Secure; Http-Only

I use mod_headers for it with following rule:


Header edit Set-Cookie ^(.*)$ $1;Secure;HttpOnly

It works fine when only one cookie is set, but if there is more than one, it just removes all the following and they are not set at all.

Any help how to write mod_headers rule for multiple values? or the problem is in something else?

Best Answer

I found the answer. Problem has been in version of apache installed on server. Edit command is supported from version 2.2.4 but the version has been 2.2.3 (default on RHEL 5+). So I upgreded httpd and everything works fine.

For more about upgrading httpd on RHEL or CentOS see:

http://www.jasonlitka.com/2007/01/17/upgrading-to-httpd-224-on-rhel-centos-4/

http://www.jasonlitka.com/yum-repository/

Related Topic