eCAP

Remove Set-Cookie header in Response

Asked by M

How would I block all Set-Cookie headers in the response?

const libecap::Name headerSetCookie("Set-Cookie");
adapted->header().removeAny(headerSetCookie);

This still lets websites place cookies on machines that use the proxy.

I have a feeling it's not the eCAP side, but something in my configuration. My squid.conf:

ecap_enable on
loadable_modules /usr/local/lib/ecap_adapter_modifying.so
ecap_service eRespmod respmod_precache 0 ecap://e-cap.org/ecap/services/sample/modifying
adaptation_service_set respFilter eReqmod
adaptation_access respFilter allow all

I'm trying to write an eCAP adapter that manages cookies network wide, as I have many devices that don't have a lot of options when it comes to cookie management. I've written adapters for request headers before that work just fine, but can't seem to get this part right. Thanks.

Question information

Language:
English Edit question
Status:
Solved
For:
eCAP Edit question
Assignee:
No assignee Edit question
Solved by:
Alex Rousskov
Solved:
Last query:
Last reply:
Revision history for this message
Best Alex Rousskov (rousskov) said : 		#1

There is also a Set-Cookie2 response header that you should delete if you want to delete all cookies.

If that is not sufficient, you need to find a specific case where cookies are slipping through and triage it. There can be something wrong in your adapter code or perhaps some responses (e.g., HTTPS/encrypted ones) bypass your adapter.

Revision history for this message
M (martijnvdwoude) said : 		#2

This is now solved. Don't know exactly what did it, but it started working when I edited the eCAP adapter URI. Also I think I forgot 'make uninstall' before.

Don't know if this needs to be posted in a new question, but here's a quick follow up question:
Can I block response headers based on request headers? E.g blocking Set-Cookie headers based on the Host request header, effectively blocking 3rd party cookies.

Revision history for this message
M (martijnvdwoude) said : 		#3

Thanks Alex Rousskov, that solved my question.

Revision history for this message
Alex Rousskov (rousskov) said : 		#4

Sure, you can code whatever decision logic you need as long as it uses available information. The request headers are available during RESPMOD via the cause() method.