# Set-Cookie is missing via proxy

**URL:** <https://www.ruby-forum.com/t/set-cookie-is-missing-via-proxy/224973>\
**Category:** NGINX\
**Created:** [December 5, 2012, 12:01pm UTC](https://www.ruby-forum.com/t/set-cookie-is-missing-via-proxy/224973 "2012-12-05T12:01:48Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [December 5, 2012, 12:01pm UTC](https://www.ruby-forum.com/t/set-cookie-is-missing-via-proxy/224973/1 "2012-12-05T12:01:48Z")

</div>

Hi,

I am using nginx as a reverse proxy for apache.  
I have the following symptom: Sessions of users get mixed up.  
The original html from the apache looks like this via curl:

[…]  
[![](https://www.ruby-forum.com/layout/cyt/img/blind.gif)](https://www.ruby-forum.com/ueber-uns/?acmeID=e58927c4c728307aa0596f23a87c8136)

[...]

If I get this page through nginx, it looks like this:  
[…]  
[![](https://www.ruby-forum.com/layout/cyt/img/blind.gif)](https://www.ruby-forum.com/ueber-uns/)

  
[…]

So obviously the query string containing the identifing ID is missing. I  
guess  
this is where sessions get mixed up. Now I had  
a look a the headers, and there I got via apache:  
curl --head [http://www.foobar-shop.de/](http://www.foobar-shop.de/)  
HTTP/1.1 200 OK  
Date: Wed, 05 Dec 2012 10:19:48 GMT  
Server: Apache  
X-Powered-By: PHP/5.2.17-0.dotdeb.0  
Set-Cookie: acmeID=48dceed9217eea2b691f75e26276bdb8; expires=Fri,  
15-Mar-2013  
10:19:48 GMT; path=/; [domain=.foobar-shop.de](http://domain=.foobar-shop.de)  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,  
pre-check=0  
Pragma: no-cache  
Content-Type: text/html;charset=UTF-8

and via nginx:  
HTTP/1.1 200 OK  
Server: nginx/1.2.5  
Date: Wed, 05 Dec 2012 10:45:54 GMT  
Content-Type: text/html; charset=iso-8859-1  
Content-Length: 945  
Connection: keep-alive  
Last-Modified: Fri, 13 Apr 2012 02:58:01 GMT  
ETag: “132b39c-3b1-4bd86a3f74040”  
Accept-Ranges: bytes  
Vary: Accept-Encoding

So the “Set-Cookie” header is missing via nginx. I guess this is the  
reason why the query  
string is also missing in the html. ( Odly though, if I browse the site  
with  
firefox, I still get the cookie …? )  
I tried setting  
proxy\_pass\_header Set-Cookie;  
but with no success.

Now I am a bit clueless.

My config:

/etc/nginx/nginx.conf  
user www-data;  
worker\_processes 16;  
pid /var/run/nginx.pid;

events {  
worker\_connections 2000;  
# multi\_accept on;  
}

http {

```
     ##
     # Basic Settings
     ##

     sendfile on;
     tcp_nopush on;
     tcp_nodelay on;
     keepalive_timeout 65;
     types_hash_max_size 2048;
     # server_tokens off;

     # server_names_hash_bucket_size 64;
     # server_name_in_redirect off;

     include /etc/nginx/mime.types;
     default_type application/octet-stream;

     ##
     # Logging Settings
     ##

     access_log /var/log/nginx/access.log;
     error_log /var/log/nginx/error.log;

     ##
     # Gzip Settings
     ##

     gzip on;
     gzip_disable "msie6";
    # gzip_vary on;
     # gzip_proxied any;
     # gzip_comp_level 6;
     # gzip_buffers 16 8k;
     # gzip_http_version 1.1;
     # gzip_types text/plain text/css application/json
     # application/x-javascript text/xml application/xml

```

application/xml+rss  
# text/javascript;

```
     # Because we have a lot of server_names, we need to increase
     # server_names_hash_bucket_size
     # (http://nginx.org/en/docs/http/server_names.html)
     server_names_hash_max_size 6000;
     server_names_hash_bucket_size 512;
                                                        # raise 

```

default  
# values for  
php  
client\_max\_body\_size 20M;  
client\_body\_buffer\_size 128k;

```
     ##
     # Virtual Host Configs
     ##
     include /var/www3/acme_cache/load_balancer/upstream.conf;
     include /etc/nginx/conf.d/*.conf;
     include /etc/nginx/sites-enabled/*;
     include /etc/nginx/proxy_params;

     index index.html index.htm ;

     ##
     # Proxy Settings
     ##

     # include hostname in request to backend
     proxy_set_header Host $host;

     # only honor internal Caching policies
     proxy_ignore_headers X-Accel-Expires Expires Cache-Control;

     # let cookies from the backend pass
     proxy_pass_header Set-Cookie;

```

}

/etc/nginx/proxy\_params  
proxy\_set\_header Host $host;  
proxy\_set\_header X-Real-IP $remote\_addr;  
proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;

/etc/nginx/conf.d/proxy\_paths.conf  
proxy\_temp\_path /var/lib/nginx/proxy/tmp;  
proxy\_cache\_path /var/lib/nginx/proxy/cache levels=2:2:2  
keys\_zone=acme-cache:800m max\_size=55000m inactive=10m;

/etc/nginx/sites-enabled/foobar-shop.de\_p80  
server  
{  
server\_name [www.foobar-shop.de](http://www.foobar-shop.de) [foobar-shop.de](http://foobar-shop.de) [foobar-beta.de](http://foobar-beta.de);  
listen 80;  
access\_log /var/log/www/asdf/foobar/log/access.log;  
error\_log /var/log/nginx/vhost\_error.log;  
proxy\_cache acme-cache;  
proxy\_cache\_key “$scheme$host$proxy\_host$uri$is\_args$args”;  
proxy\_cache\_valid 200 302 60m;  
proxy\_cache\_valid 404 10m;

```
     location ~* \.(jpg|gif|png|css|js)
     {
             try_files $uri @proxy;
     }

     location @proxy
     {
             proxy_pass http://backend-all-apaches;
     }

     location /
     {
             proxy_pass http://backend-all-apaches;
     }

```

}

Any Ideas?

Isaac

---

<div class="post-metadata">

**Author:** ![Isaac\_H](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/e480ec/32.png) [@Isaac\_H](https://www.ruby-forum.com/u/Isaac_H)\
**Post date:** [December 5, 2012, 1:23pm UTC](https://www.ruby-forum.com/t/set-cookie-is-missing-via-proxy/224973/2 "2012-12-05T13:23:38Z")

</div>

Hello!

On Wed, Dec 05, 2012 at 12:00:51PM +0100, Isaac H. wrote:

> If I get this page through nginx, it looks like this:  
> HTTP/1.1 200 OK  
> Content-Type: text/html;charset=UTF-8  
> Accept-Ranges: bytes  
> Vary: Accept-Encoding
> 
> So the “Set-Cookie” header is missing via nginx. I guess this is the  
> reason why the query  
> string is also missing in the html. ( Odly though, if I browse the site with  
> firefox, I still get the cookie …? )

I would suggest it’s backend code/configs which needs  
investigation. It looks like the backend returns static file  
(note Content-Length, ETag and no X-Powered-By) to nginx for some  
reason.

[…]

–  
Maxim D.

> **[F5 NGINX: Built for cloud-native apps. Ready for AI traffic.](https://www.f5.com/products/nginx)**
>
> Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises.

---

<div class="post-metadata">

**Author:** ![Isaac\_H](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/e480ec/32.png) [@Isaac\_H](https://www.ruby-forum.com/u/Isaac_H)\
**Post date:** [December 5, 2012, 8:43pm UTC](https://www.ruby-forum.com/t/set-cookie-is-missing-via-proxy/224973/3 "2012-12-05T20:43:01Z")

</div>

On 12/05/2012 01:23 PM, Maxim D. wrote:

> I would suggest it’s backend code/configs which needs  
> investigation. It looks like the backend returns static file  
> (note Content-Length, ETag and no X-Powered-By) to nginx for some  
> reason.  
> Am I understanding you correctly: you suggest that for some reason the  
> backend is delivering a page without the query string, so nginx has no  
> chance to deliver it?

Isaac

---

<div class="post-metadata">

**Author:** ![Isaac\_H](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/e480ec/32.png) [@Isaac\_H](https://www.ruby-forum.com/u/Isaac_H)\
**Post date:** [December 5, 2012, 9:12pm UTC](https://www.ruby-forum.com/t/set-cookie-is-missing-via-proxy/224973/4 "2012-12-05T21:12:49Z")

</div>

Also, at least from the config, the html should not be cached, right?  
I will also check the communication with the backend(there currently is  
a different problem which prevents this check) to see which headers are  
passed between nginx and the backend, and compare them with the headers  
sent between the client and nginx.

Anything else I could do to investigate?

Isaac

---

<div class="post-metadata">

**Author:** ![Isaac\_H](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/e480ec/32.png) [@Isaac\_H](https://www.ruby-forum.com/u/Isaac_H)\
**Post date:** [December 6, 2012, 4:17pm UTC](https://www.ruby-forum.com/t/set-cookie-is-missing-via-proxy/224973/5 "2012-12-06T16:17:50Z")

</div>

On 06.12.2012 14:37, Maxim D. wrote:

> > Also, at least from the config, the html should not be cached,  
> > right?
> 
> I don’t see anything in the config you provided which will prevent  
> caching.

location ~\* .(jpg|gif|png|css|js)  
{  
try\_files $uri @proxy;  
}

```
     location @proxy
     {
             proxy_pass http://backend-all-apaches;
     }

     location /
     {
             proxy_pass http://backend-all-apaches;
     }

```

As far as my understanding goes, this will only cache  
jpg|gif|png|css|js files, and send the rest directly to the backend.  
Please correct me if I am wrong.

Isaac

---

<div class="post-metadata">

**Author:** ![Isaac\_H](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/e480ec/32.png) [@Isaac\_H](https://www.ruby-forum.com/u/Isaac_H)\
**Post date:** [December 6, 2012, 2:37pm UTC](https://www.ruby-forum.com/t/set-cookie-is-missing-via-proxy/224973/6 "2012-12-06T14:37:55Z")

</div>

Hello!

On Wed, Dec 05, 2012 at 09:12:09PM +0100, Isaac H. wrote:

> Also, at least from the config, the html should not be cached, right?

I don’t see anything in the config you provided which will prevent  
caching.

[…]

> > > I would suggest it’s backend code/configs which needs  
> > > investigation. It looks like the backend returns static file  
> > > (note Content-Length, ETag and no X-Powered-By) to nginx for some  
> > > reason.  
> > > Am I understanding you correctly: you suggest that for some reason the  
> > > backend is delivering a page without the query string, so nginx has no  
> > > chance to deliver it?

Yes.

–  
Maxim D.

> **[F5 NGINX: Built for cloud-native apps. Ready for AI traffic.](https://www.f5.com/products/nginx)**
>
> Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises.

---

<div class="post-metadata">

**Author:** ![Isaac\_H](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/e480ec/32.png) [@Isaac\_H](https://www.ruby-forum.com/u/Isaac_H)\
**Post date:** [December 6, 2012, 5:03pm UTC](https://www.ruby-forum.com/t/set-cookie-is-missing-via-proxy/224973/7 "2012-12-06T17:03:26Z")

</div>

Hello!

On Thu, Dec 06, 2012 at 04:16:50PM +0100, Isaac H. wrote:

> ```
> try_files $uri @proxy;
> }
> 
> ```
> 
> As far as my understanding goes, this will only cache  
> jpg|gif|png|css|js files, and send the rest directly to the backend.  
> Please correct me if I am wrong.

You are wrong. It tries to lookup jpg/gif/png/css/js files  
directly on the file system as static files, but it’s

1. Not cache. Cache is activated with proxy\_cache directive, see  
[Module ngx\_http\_proxy\_module](http://nginx.org/r/proxy_cache).

2. Not related to html files you talked about.

3. Not related to the response in question as headers clearly  
indicate it was originally returned by Apache (note ETag in Apache  
format).

Whether or not the response in question was cached can’t be  
concluded from the information provided. Most likely it was as  
config says to cache all 200 responses (without cookies) for 60  
minutes.

–  
Maxim D.

> **[F5 NGINX: Built for cloud-native apps. Ready for AI traffic.](https://www.f5.com/products/nginx)**
>
> Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises.

---

<div class="post-metadata">

**Author:** ![Isaac\_H](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/e480ec/32.png) [@Isaac\_H](https://www.ruby-forum.com/u/Isaac_H)\
**Post date:** [December 17, 2012, 11:02am UTC](https://www.ruby-forum.com/t/set-cookie-is-missing-via-proxy/224973/8 "2012-12-17T11:02:35Z")

</div>

On 12/06/2012 05:02 PM, Maxim D. wrote:

> > ```
> > location /
> > 
> > ```
> 
> concluded from the information provided. Most likely it was as  
> config says to cache all 200 responses (without cookies) for 60  
> minutes.  
> Thank you Maxim, that was very helpfull! So indeed, my config was wrong,  
> so in debugging the original problem, I made wrong assumptions.

Now for the original problem:  
The Set-Cookie was not missing, but it turned out that having  
proxy\_set\_header Host $host;  
twice as I did accidentally, “confused” the backend, which is why it did  
not deliver the Set-Cookie header. Removing one instance solved that  
problem. But that did not solve the session mixing. The session mixing  
was due to  
proxy\_ignore\_headers X-Accel-Expires Expires Cache-Control;  
I set this earlier, because not every page set those headers correctly,  
resulting in suboptimal cacheing. But it turns out that its really  
needed for other pages, so I removed that line again. This solved the  
session mixing problem.

Isaac