Cookie path rewrite problem

[nlaszlo2]

We are using HTTP-Proxy-Servlet to proxy an application. Our scenario do not allow a host to host proxy, so we are proxying all first level URI-s needed.

1. myapp/* -> realserver:8080/Lite (main)
2. auth/* -> realserver:8080/auth
3. api/* -> realserver:8080/api

The main app sends a javascript responsible for authentication. The script posts auth information to /auth and the respond sets Session cookies that should be used later with /api and main (/Lite). The realserver respond contains the below Set-Cookie headers:
Set-Cookie: ss-id=s2UG4gw2vAgTr0RPs2gA;path=/;domain=xxx;Secure;HttpOnly
Set-Cookie: ss-pid=vx1semN82iEKb8UEk5hZ;path=/;expires=Mon, 26 Apr 2038 11:27:36 GMT;domain=xxx;Secure;HttpOnly
Set-Cookie: ss-opt=perm;path=/;expires=Mon, 26 Apr 2038 11:27:36 GMT;domain=xxx;HttpOnly

But on the client side with get these cookies:
Set-Cookie: ss-id=s2UG4gw2vAgTr0RPs2gA;path=/auth;domain=xxx;Secure;HttpOnly
Set-Cookie: ss-pid=vx1semN82iEKb8UEk5hZ;path=/auth;expires=Mon, 26 Apr 2038 11:27:36 GMT;domain=xxx;Secure;HttpOnly
Set-Cookie: ss-opt=perm;path=/auth;expires=Mon, 26 Apr 2038 11:27:36 GMT;domain=xxx;HttpOnly

this results that the browser is not sending the Cookies to further requests to myapp/ and api/. I see the function copyProxyCookie cause this to happen, but has no option to keep original path or only replace according to mapping rules. Do you have any suggestion?

[dsmiley]

Aha; I see.

Well, you could override copyProxyCookie; the servlet aims to be very extensible. You could call super.copyProxyCookie and pass a new HttpServletResponseWrapper with addCookie overridden with path manipulation in there. The javadocs might mention this to make cookie customization clearer.

I'm not sure if there is a generalized solution here but I'm open to suggestions. I'd rather not add some mapping rules unless there's a default trivial one you can suggest. Well in a sense there is one now and it's the existing path computation logic in there. Perhaps if we extract a new method that sets the outgoing servetCookie path, you could then override it, which is less work than overriding copyProxyCookie?

[nlaszlo2]

I think the correct implementation would be that without the host part is searched in the path of the cookie and if found is replaced with without ending "*" and "/" so if the rule is to proxy /myapp to remoteserver/remoteapp than "/remoteapp" is replaced to "/myapp" in the path but if the path is "/" it is untouched.

[dsmiley]

Yeah that makes sense; I'll do that. Can you do a PR (with test) please?

[nlaszlo2]

Sure

[royling]

@nlaszlo2 do you get any chance to work on the PR?