# NGINX and Cookies are hijacking on clients on the same network(NAT)

**URL:** <https://www.ruby-forum.com/t/nginx-and-cookies-are-hijacking-on-clients-on-the-same-network-nat/215204>\
**Category:** NGINX\
**Created:** [December 26, 2011, 6:19pm UTC](https://www.ruby-forum.com/t/nginx-and-cookies-are-hijacking-on-clients-on-the-same-network-nat/215204 "2011-12-26T18:19:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [December 26, 2011, 6:19pm UTC](https://www.ruby-forum.com/t/nginx-and-cookies-are-hijacking-on-clients-on-the-same-network-nat/215204/1 "2011-12-26T18:19:50Z")

</div>

We are experiencing a problem after the adoption of nginx as a server  
(apache had before).

It turns out that we are seeing many cases of clients that access data  
from other users in the session. This is because the login system (PHP)  
are stored in cookies. These cookies are being “shared” in computers on  
the same corporate network.

We realize that this problem only happens for several customers who are  
on the same network - that is, have the same external IP shared via  
single access point(NAT).

We’ve tried to do much to avoid the problem by adding validations and  
hash on cookies, but eventually realized that our server simply can not  
store cookies properly, and for the same network multiple machines share  
the cookie, which must be just a browser .

We are not sure if the problem is in NGINX, but we suspect it before the  
migration of APACHE → nginx does not have the problem.

Is there some setting that can be done to remedy this problem?

Thanks for the help!

Posted at Nginx Forum:

> **[NGINX and Cookies are hijacking on clients on the same network(NAT)](https://forum.nginx.org/read.php?2,220498,220498#msg-220498)**
>
> We are experiencing a problem after the adoption of nginx as a server (apache had before). It turns out that we are seeing many cases of clients that access data from other users in the session. This is because the login system (PHP) are stored in...

---

<div class="post-metadata">

**Author:** ![joao\_neto](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/a9a28c/32.png) [@joao\_neto](https://www.ruby-forum.com/u/joao_neto)\
**Post date:** [December 26, 2011, 8:28pm UTC](https://www.ruby-forum.com/t/nginx-and-cookies-are-hijacking-on-clients-on-the-same-network-nat/215204/2 "2011-12-26T20:28:22Z")

</div>

Hello!

On Mon, Dec 26, 2011 at 12:18:54PM -0500, joao\_neto wrote:

> single access point(NAT).
> 
> We’ve tried to do much to avoid the problem by adding validations and  
> hash on cookies, but eventually realized that our server simply can not  
> store cookies properly, and for the same network multiple machines share  
> the cookie, which must be just a browser .
> 
> We are not sure if the problem is in NGINX, but we suspect it before the  
> migration of APACHE → nginx does not have the problem.
> 
> Is there some setting that can be done to remedy this problem?

I suspect the problem isn’t NAT, but instead corporate proxy with  
cache. Symptoms described suggest that cookies are set without  
proper cache-control headers to prevent caching.

This may be either backend problem (i.e. you just don’t add proper  
headers in php; usually this is handled by php automatically as  
described in [1], though may be improperly configured) or nginx  
configuration problem (it’s easy to strip/change headers in nginx, and  
you could accidently do it).

[1] [PHP: session\_cache\_limiter - Manual](http://php.net/manual/en/function.session-cache-limiter.php)

Maxim D.