仅当没有 Cookie 时，如何在 Cookie 上设置安全和 HTTP 标志？ ( .htaccess )

Question

I am currently using this htaccess to add a secure and HTTPonly

Header always edit Set-Cookie (.*) "$1; HTTPOnly; Secure"

but because one cookie on this Domain already has this flags, how can I only apply it to the ones that doesnt have it? Because I dont have direct access to the Server it needs to be done via a .htaccess

Answer 1

The Solution to this Question was this:

Header always edit Set-Cookie (.*) "$1; HttpOnly; Secure"
#Strip off double Secure or HttpOnly settings as if App and Apache sets above you can sometimes get both
Header always edit Set-Cookie (?i)^(.*);\s?Secure;?\s?(.*)?;?\s?Secure;?\s?(.*)$ "$1; $2; $3; Secure"
Header always edit Set-Cookie (?i)^(.*);\s?HttpOnly;?\s?(.*)?;?\s?HttpOnly;?\s?(.*)$ "$1; $2; $3; HttpOnly"
#Strip off double ;; settings
Header always edit* Set-Cookie (;\s?){2,} "; "

Answer 2

The following approach will check it the browser did send us the HTTPOnly and Secure Cookie. If those are not include you can set it with the Header command as usual.

<If "%{HTTP_COOKIE}" !=~ "m#HTTPOnly.*Secure#">
    Header always edit Set-Cookie (.*) "$1; HTTPOnly; Secure"
</If>

This is only working with apache 2.4+