'How to use nginx cookies from proxy response only?

Setup

Currently each subdomain contains a different device that has different cookies. That device is sensitive to any cookie or session changes(stops working). Those devices are from different manufacturers and each day new ones are added or old ones removed.

Problem

subdomain contains cookies & sessions from main domain, I need to somehow strip them or isolate subdomain from main domain.

  • I don't have ability to make any changes to main domain.
  • I understand that by using a different domain this problem is solved, but I don't have that option.
  • Main domain may unexpectedly add or remove any number of cookies(so a whitelist of cookies won't work).
  • Devices may contain authentication page & constaly can change cookies or session.
  • After closing a browser & opening the subdomain again - the cookies should be cleared.
  • Idealy by opening a new tab, the cookies & sessions should also be fresh - but this is not a must.

Half solution

Basically I strip specific cookies from request(unfortunately this works only, if cookie list never changes in main domain).

Nginx setup(the important part)

server {
    listen 443 ssl;
    server_name  ~^(?<subdomain>[^.]+)\.coolsite.com$;
    include /etc/nginx/snippets/tls-coolsite-com.conf;
    limit_req zone=global_req_limit_zone burst=100 delay=90;

    add_header "Content-Security-Policy" "form-action 'self' coolsite.com *.coolsite.com" always;
    add_header "Content-Security-Policy" "frame-ancestors 'self' coolsite.com *.coolsite.com" always;
    add_header "Referrer-Policy" "strict-origin";
    add_header "Vary" "Origin";
    location / {
        proxy_http_version 1.1;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_hide_header X-Powered-By;
        proxy_pass http://127.0.0.1:10080/;
        proxy_redirect http:// https://;

        set $stripped_cookie $http_cookie;
        if ($http_cookie ~ "(.*)(?:^|;)\s*rms_at=[^;]+(.*)$") {
            set $stripped_cookie $1$2;
        }
        if ($stripped_cookie ~ "(.*)(?:^|;)\s*rms_rt=[^;]+(.*)$") {
            set $stripped_cookie $1$2;
        }
        if ($stripped_cookie ~ "(.*)(?:^|;)\s*RMS-XSRF-TOKEN=[^;]+(.*)$") {
            set $stripped_cookie $1$2;
        }
        if ($stripped_cookie ~ "(.*)(?:^|;)\s*_ga=[^;]+(.*)$") {
            set $stripped_cookie $1$2;
        }
        if ($stripped_cookie ~ "(.*)(?:^|;)\s*_gid=[^;]+(.*)$") {
            set $stripped_cookie $1$2;
        }
        if ($stripped_cookie ~ "(.*)(?:^|;)\s*_gat_gtag[^;]+(.*)$"){
            set $stripped_cookie $1$2;
        }
        if ($stripped_cookie ~ "^[;]+(.*)") {
            set $stripped_cookie $1;
        }
        proxy_set_header Cookie $stripped_cookie;
   }
}

A stupid idea(that probably won't work)

Maybe, it would be possible to always use only the cookies that were returned from response? And strip any cookies that were provided from request?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source