I have Apache running as a secure proxy (Port 443) between an HTTPS site and the rest of the world. This site is setting a secure, httpOnly cookie. The cookie when seen in a trace shows up in a response packet shown below:
... Other headers
Content-Length: 366
Set-Cookie: Cookie=!bZ..mumbojumbo..; Secure; path=/; Httponly; Secure
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
.... Other content
I have the http-ssl.conf setup the following way:
#Set the Our NEW Cookie to the content of secure cookie present.
RewriteCond %{HTTP_COOKIE} Cookie=([^;]+) [NC]
RewriteRule ^(.*)$ /$1 [L,CO=NewCookie:%1:our.proxy.com:1440:/]
On the response, I am not able to see this rule trigger [NewCookie is not set]
Does mod_rewrite explicitly forbid access to httpOnly cookie?