Home / server / Questions / 788207
Accepted
rugk
Asked: 2016-07-07 03:04:45 +0800 CST

How to use a hyphen in cookie names for nginx?

  • 772

I want to use the new cookie-prefixes, which are not yet standardized by the IETF. These are __Secure- and __Host-.

So let's e.g. set this cookie (here the header returned by the server):

Set-Cookie: "__Host-apple=yummy; Secure; HttpOnly; Path=/"

I want to access this cookie now in nginx with the $cookie- variable. So for testing I use the echo module to show me the value of the cookie:

location = /wannaeat/ {
        echo $cookie___Host-apple;
}

However nginx always shows me -apple. It seems to use the hyphen (-) to split the variable.

Because when I e.g. name the cookie __Host_apple (and the nginx variable $cookie___Host_apple) nginx shows me the value correctly.

I know I could probably use $http_cookie and use a regular expression to find the correct cookie, but this is not possible as I want to map the cookie value.

nginx cookie http-cookie

1 Answers

  1. Best Answer

    First of all, map does, in fact, support matching on regular expressions:

    Source values are specified as strings or regular expressions (0.9.6).

    (Thus you should probably be good to go!)

    However, for the sake of discussion and commentary, since what you're attempting to use is not a standard yet, you better go to their mailing lists or whatnot, and tell them that what they're proposing to do is a really bad idea.

    Just for the sake of it, I went to the Cookie Manager in my browser, to make a look at the use of _ the underscore versus - the shortest dash. The underscore is heavily used by at least 90% of sites/cookies, whereas dash usage within cookies is probably way below 5%.

    The reason why - is not valid in variable names is very straightforward and is as old as day -- because the symbol is often used in pretty much all programming languages in place of the minus sign (dash, minus, mdash: -−—). In turn, as per re_format(7) and pcrepattern(3), this scenario is also part of the widely used regular expression implementations, where an underscore is always considered to be a part of a word, whereas a dash symbol is not.

    I'd imagine the same issue will repeat itself in many other languages as well as with nginx.conf.

    • 2