Overwriting cookies in htaccess

Question

I run a website in a quite cheap shared hosting environment (LAMP): technically speaking, in this context the only thing I can do is edit one or more htaccess files.

Maybe for load balancing purposes, the host serves two unsecure cookies.

Is there any way to set the Secure flag on both cookies from an htaccess file, overwriting their original values?

Answer 1

tl;dr You probably can't do anything to influence the cookie the host is setting "for load balancing purposes".

---

Cookie set by application server

If the cookie is being set on your application server, then you can possibly intercept the response and override the Set-Cookie HTTP response header.

For example, based on an answer on StackOverflow, the following would unconditionally append the Secure flag when setting the cookie "MYCOOKIE" using Apache's mod_headers:

Header always edit Set-Cookie ^(MYCOOKIE=.+) "$1; Secure"

Or, based on another answer on ServerFault, the following uses a negative lookahead to first check that the Secure is not already set on the cookie:

Header always edit Set-Cookie "(?i)^(MYCOOKIE=(?:(?!;\s?secure).)+)$" "$1; Secure"

---

Cookie set by proxy/load balancer

HOWEVER, if the cookie is being set by a load balancer/proxy that is out of your control then the above method probably won't work. And any attempt to override the cookie may itself get overridden again by the proxy server, depending on when the proxy sets the cookie.

You could try something like the following using mod_rewrite, but bear in mind that you will also need to manually set the domain and path (and lifetime) parts of the cookie exactly the same as they are set by the host (eg. by checking the initial Set-Cookie HTTP response header you see in the browser), otherwise it won't override the same cookie. For example:

RewriteEngine On

RewriteCond %{HTTP_COOKIE} (MYCOOKIE)=([^;]+)
RewriteRule ^ - [CO=%1:%2:.example.com:1440:/:secure]

%1 is a backreference to the cookie name (eg. MYCOOKIE) in the preceding RewriteCond directive. And %2 is the corresponding value. .example.com, 1440 and / are the domain, lifetime (in minutes) and URL-path respectively of the cookie that you are trying to set and will need to be set manually.

However, as mentioned above, this may not do anything, as the proxy may simply overwrite this.

Reference:

• https://httpd.apache.org/docs/2.4/rewrite/flags.html#flag_co
• https://httpd.apache.org/docs/current/mod/mod_headers.html#header