[techtalk] Apache & cookies

[eito]

On Wed, Jun 28, 2000 at 01:00:12AM -0700, Jeff Frasca wrote:
> On Tue, 27 Jun 2000, Yvonne wrote:
> 
> > Next question... Where can I look server side in Apache to see if we're
> > using cookies? I've looked through documentation, and I read the stuff
> > on mod_usertrack, but we don't have this module loaded.  Are there
> > others?  We've located the cookies in one script someone uses, but want
> > to cover our bases for our privacy/web policy. (Someone outside is
> > asking for info under open records.)
> 
> IIRC, cookies are usually only set by scripts.  There might be an
> exception to this, check the docs on the modules you have installed.
> The apache config file is centralized, but I've never heard of anything
> in there related to cookies (I've messed with a couple configs, but only
> for small servers with mod_php installed -- and the only place I've ever
> dealt with a cookie is in a script).

Hi,

You can log usage of cookies with 'CustomLog' directive. (It is in
mod_custom_log, which should be installed by default.) For example,
in Apache's config file, you can put like:

  CustomLog /var/log/apache_cookie_log "%{Set-Cookie}o %r %t"

Within {} for %o format, you can set any HTTP reply elements.


But, this only logs if cookie is set within HTTP header (e.g. via CGI
script or module like mod_usertrack). You can set cookie with <META>
tag like:

  <META http-equiv="Set-Cookie" content="SessionID=foo; path=/; \
        expires=Wed, 28-Jun-2000 12:00:00 GMT">

I think that this is not common way, so you should be able to log
most of cookie activity via 'CustomLog'.


Hope this helps,

:eito