# Proxy domain rewrite using proxy\_cookie\_domain **URL:** \ **Category:** NGINX\ **Created:** [February 12, 2016, 8:22pm UTC](https://www.ruby-forum.com/t/proxy-domain-rewrite-using-proxy-cookie-domain/244055 "2016-02-12T20:22:38Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\ **Post date:** [February 12, 2016, 8:22pm UTC](https://www.ruby-forum.com/t/proxy-domain-rewrite-using-proxy-cookie-domain/244055/1 "2016-02-12T20:22:38Z")
I want to rewrite domains in the cookie when NGIX is acting as reverse proxy. I see that NGIX support this using proxy\_cookie\_domain module. But I am unable to find out where does it keep the original domain which is being replaced? In my opinion NGIX would need the original domain to find out where to send the cookie when it comes back to NIGX in next request. Let’s says NGIX domain is: [external.com](http://external.com) backend server #1 sets cookie domain as: [server1.com](http://server1.com) backend server #2 sets cookie domain as: [server2.com](http://server2.com) Both these domains are replaced by NGIX to NGIX’s domain so both cookies’ domain is now [external.com](http://external.com) when the request comes to NGIX, both these cookies will be sent by browser to NGIX, now how does NGIX decide which cookies to be sent to the backend server? it needs to keep the original domain mapping to find this how, does it keep somewhere? please help in answering this question. Posted at Nginx Forum: > **[Proxy domain rewrite using proxy\_cookie\_domain](https://forum.nginx.org/read.php?2,264499,264499#msg-264499)** > > I want to rewrite domains in the cookie when NGIX is acting as reverse proxy. I see that NGIX support this using proxy\_cookie\_domain module. But I am unable to find out where does it keep the original domain which is being replaced? In my opinion... ---
**Author:** ![nitin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/d78d45/32.png) [@nitin](https://www.ruby-forum.com/u/nitin)\ **Post date:** [February 15, 2016, 7:29am UTC](https://www.ruby-forum.com/t/proxy-domain-rewrite-using-proxy-cookie-domain/244055/2 "2016-02-15T07:29:39Z")
Thanks for reply. In case client is just a browser then it will send all the cookies with NGIX domain which means that NGIX will send all the cookies to backend server irrespective of who initially set it in set-cookie header… This could be a security issue then. Posted at Nginx Forum: > **[Re: Proxy domain rewrite using proxy\_cookie\_domain](https://forum.nginx.org/read.php?2,264499,264537#msg-264537)** > > I want to rewrite domains in the cookie when NGIX is acting as reverse proxy. I see that NGIX support this using proxy\_cookie\_domain module. But I am unable to find out where does it keep the original domain which is being replaced? In my opinion... ---
**Author:** ![nitin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/d78d45/32.png) [@nitin](https://www.ruby-forum.com/u/nitin)\ **Post date:** [February 13, 2016, 2:54am UTC](https://www.ruby-forum.com/t/proxy-domain-rewrite-using-proxy-cookie-domain/244055/3 "2016-02-13T02:54:36Z")
Hello! On Fri, Feb 12, 2016 at 02:22:20PM -0500, nitin wrote: > Both these domains are replaced by NGIX to NGIX’s domain so both cookies’ > domain is now [external.com](http://external.com) > > when the request comes to NGIX, both these cookies will be sent by browser > to NGIX, now how does NGIX decide which cookies to be sent to the backend > server? it needs to keep the original domain mapping to find this how, does > it keep somewhere? The domain is only present in Set-Cookie response headers, but it is not available in HTTP requests. The client decides which cookies to send back to nginx in the Cookie request header, and nginx just passes the header with all cookies unmodified. – Maxim D. > **[nginx](http://nginx.org/)** ---
**Author:** ![nitin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/d78d45/32.png) [@nitin](https://www.ruby-forum.com/u/nitin)\ **Post date:** [February 15, 2016, 2:06pm UTC](https://www.ruby-forum.com/t/proxy-domain-rewrite-using-proxy-cookie-domain/244055/4 "2016-02-15T14:06:53Z")
Hello! On Mon, Feb 15, 2016 at 01:29:01AM -0500, nitin wrote: > Thanks for reply. > In case client is just a browser then it will send all the cookies with NGIX > domain which means that NGIX will send all the cookies to backend server > irrespective of who initially set it in set-cookie header.. This could be a > security issue then. For sure - if you are using untrusted backend servers in your domain this can be a security issue. Regardless of what nginx does, actually - just Set-Cookie may be enough to be an issue. Moreover, any javascript returned by a backend server will be able to read all cookies as well. Of course this should be considered when using multiple backend servers within a single domain. – Maxim D. > **[nginx](http://nginx.org/)**