apache How to use "Header set Set-Cookie expires=<date>" dynamically

Question

I am using apache as a load balancer and reverse proxy. For session stickiness I am creating a cookie with the route of the node.

Header set Set-Cookie "h=.%{BALANCER_WORKER_ROUTE}e; path=/; domain=.domain.com" env=BALANCER_ROUTE_CHANGED

How do I set the expires value in the cookie to be X minutes from when the request comes in?

The documentation for mod_headers Doesn't even cover Set-Cookie in detail so there is no info there on a dynamic syntax to use for expires.

I tried setting the max-age but unfortunatelly max-age doesn't work with IE 11 and lots of our customers use it.

The docs for mod_rewrite cookie do cover how to set a lifetime in the cookie so I can get it to work using this ugly mod_rewrite hack but I had to do one rule per route since it didn't work inside my <Proxy balancer://my_cluster> section:

RewriteCond %{HTTP_COOKIE} h=.1 [NC]
RewriteRule . -  [CO=h:.1:.domain.com:30:/]
RewriteCond %{HTTP_COOKIE} h=.2 [NC]
RewriteRule . -  [CO=h:.2:.domain.com:30:/]
RewriteCond %{HTTP_COOKIE} h=.3 [NC]
RewriteRule . -  [CO=h:.3:.domain.com:30:/]
RewriteCond %{HTTP_COOKIE} h=.4 [NC]
RewriteRule . -  [CO=h:.4:.domain.com:30:/]
RewriteCond %{HTTP_COOKIE} h=.5 [NC]
RewriteRule . -  [CO=h:.5:.domain.com:30:/]
RewriteCond %{HTTP_COOKIE} h=.6 [NC]
RewriteRule . -  [CO=h:.6:.domain.com:30:/]
RewriteCond %{HTTP_COOKIE} h=.7 [NC]
RewriteRule . -  [CO=h:.7:.domain.com:30:/]
RewriteCond %{HTTP_COOKIE} h=.8 [NC]
RewriteRule . -  [CO=h:.8:.domain.com:30:/]

Any ideas on how to accomplish with Header set Set-Cookie? Thanks!

Weakly

Answer 1

Maybe you could keep your idea with a generic rule

RewriteCond %{HTTP_COOKIE} h=\.([1-8]) [NC]
RewriteRule . - [CO=h:.%1:.domain.com:30:/]

Quinquevalent

+1 Thanks for the rule. I didn't dig more into making that part generic because I want to be able to accomplish it with Header set Set-Cookie, otherwise I am setting a cookie without a timeout to right after rewrite it. This is what I am using for now though. – Weakly

I'm not aware of another way of doing it, except with Header and this code. Is there a particular reason you only want to achieve it with Header ? Personally, i would have done it as i answered. Maybe you could describe what's the context and why you have to do it, then we could see if it exists a better option – Quinquevalent

Just because I am setting the cookie and then rewriting it. That seems rather wasteful. – Weakly

Answer 2

I looked at the paypal sites cookie and found they set the cookie time to past year -(01 -01-1970). The reason behind this could be to stop reuse of cookies.

Trollop