ngx.redirect: ngx.header["Set-Cookie"] doesn't work

rohit.c.joshi · 2015-12-22T02:25:17+00:00

Hello! On Sat, Dec 19, 2015 at 10:28 PM, Yichun Zhang (agentzh) wrote: > I've just kicked out OpenResty 1.9.7.1 RC1 for testing: > > https://op...

ngx.redirect: ngx.header["Set-Cookie"] doesn't work

rohit.c.joshi

Hello,

I am trying to reset the cookie when request is redirected to the login page. Set-Cookie header doesn't work when ngx.redirect is use but other headers seem to work fine. See below response send by the OpenResty where header 'Test' is populated but Set-Cookie is absent.

<code>

access_by_lua_block {

if string.match(ngx.var.uri, "/logout") then

ngx.header["Set-Cookie"] = {}

ngx.header["Test"] = "test"

ngx.log(ngx.DEBUG, "LOGOUT")

return ngx.redirect("/login.html?logout=true")

end

}

</code>

Response:

HTTP/1.1 302 Moved Temporarily

Server: openresty/1.9.3.2rc3

Date: Mon, 21 Dec 2015 18:23:35 GMT

Content-Type: text/html

Content-Length: 167

Connection: keep-alive

Test: test

Location: /login.html?logout=true

agentzh

Hello!

On Mon, Dec 21, 2015 at 10:25 AM, RJoshi <rohit....@gmail.com> wrote:
> <code>
>     access_by_lua_block {
>
>               if string.match(ngx.var.uri, "/logout") then
>                  ngx.header["Set-Cookie"] = {}

It seems that you're clearing the Set-Cookie header here yourself? Try
setting it to something meaningful like "foo=bar".

Regards,
-agentzh

rohit.c.joshi

got it. I thought by passing {} will send header Set-Cookie: "". Passing ngx.header["Set-Cookie"] = "secure=true;" which hopefully force browser to override cookie with only this value.

On Monday, 21 December 2015 13:48:48 UTC-5, agentzh wrote:

Hello!

On Mon, Dec 21, 2015 at 10:25 AM, RJoshi <rohit....@gmail.com> wrote:
> <code>
> access_by_lua_block {
>
> if string.match(ngx.var.uri, "/logout") then
> ngx.header["Set-Cookie"] = {}

It seems that you're clearing the Set-Cookie header here yourself? Try
setting it to something meaningful like "foo=bar".

Regards,
-agentzh

agentzh

Hello!

On Mon, Dec 21, 2015 at 12:07 PM, RJoshi wrote:
> got it.  I thought by passing {} will send header Set-Cookie: "".

No. Otherwise it would waste bandwidth :)

>   Passing
> ngx.header["Set-Cookie"] = "secure=true;" which hopefully force browser to
> override cookie with only this value.
>

Yes, it should.

Regards,
-agentzh