Take the 2-minute tour ×

We have an application that cares about the order of cookie headers. It shouldn't, since this isn't mandated by the standards and indeed we're getting the headers in various different orders

So we would like to rewrite the headers in Apache so that the cookie headers always appear in a specific order. Is there any way of doing this?

An ideal solution would be specifically about cookie headers, but something that lets us mess with the header order more generally would do too.

EDIT: Turns out this may be a red herring and it's actually a problem with the format of the cookie: line produced by the embedded system (sometimes). But this is still useful stuff to know

share|improve this question
Do you mean the order in which the cookies are sent by the browser to the server? –  DisgruntledGoat Nov 9 '10 at 17:12
@DG, yes. The "browser" is an embedded device, the app is weblogic (actually the weblogic apache plugin), so we don't control either end –  Paul Nov 9 '10 at 18:15
WebLogic requires cookies to be sent in a specific order? –  Lèse majesté Nov 9 '10 at 19:52
No, it's a bug in the plugin. But we need to work around it. –  Paul Nov 9 '10 at 20:10

1 Answer 1

up vote 4 down vote accepted

You could read the values of the cookies into ENV variables, unset the headers using mod_headers RequestHeader directives, and then set the headers again.

Update: Solution for reading cookie values into ENV vars and then manipulating headers to control Set-Cookie header order.

<IfModule mod_rewrite.c>
  RewriteEngine on

  # Read cookie1 into ENV:COOKIE1
  RewriteCond %{HTTP_COOKIE} cookie1=([^;]+) [NC]
  RewriteRule (.*) - [E=COOKIE1:%1]

  # Read cookie2 into ENV:COOKIE2
  RewriteCond %{HTTP_COOKIE} cookie2=([^;]+) [NC]
  RewriteRule (.*) - [E=COOKIE2:%1]


<IfModule mod_headers.c>
  Header set Set-Cookie "cookie1=%{COOKIE1}e; path=/;" env=COOKIE1
  Header set Set-Cookie "cookie2=%{COOKIE2}e; path=/;" env=COOKIE2

Tested and working on my configuration (you can experiment by swapping the Header set Set-Cookie directives).

share|improve this answer
Ah ha! I'd thought of the setting part but couldn't work out how to do the reading them into ENV vars. How do I put specific cookies into specific vars, though? The examples do it for specifi headers, but here it's the cookie: header always –  Paul Nov 9 '10 at 18:13
@Paul - Updated with example (which worked just dandy on my config) –  danlefree Nov 9 '10 at 19:05

Your Answer


