make mod_cache not cache cookies but cache contents from application side

Hi,

Is there a way to forbid caching cookies from application level (let say php
or mod_perl level) by mod_cache? I know method via apache config but trying
to find one via application level. Of course I would like the rest (bodies)
to be actually cached but not cookies itself.

mod_cache from 2.2.14 is doing crazy things like leaking user A cookie to
the user B which for me is serious security issue.

--
Arkadiusz Miśkiewicz PLD/Linux Team
arekm / maven.pl http://ftp.pld-linux.org/


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: make mod_cache not cache cookies but cache contents

--000e0cd761d04d0538047730a80d
Content-Type: text/plain; charset=ISO-8859-2
Content-Transfer-Encoding: quoted-printable

Read the mode_cache directive on the apache site and you will find your
answer


2009/10/31 Arkadiusz Mi=B6kiewicz

>
> Hi,
>
> Is there a way to forbid caching cookies from application level (let say
> php
> or mod_perl level) by mod_cache? I know method via apache config but tryi=
ng
> to find one via application level. Of course I would like the rest (bodie=
s)
> to be actually cached but not cookies itself.
>
> mod_cache from 2.2.14 is doing crazy things like leaking user A cookie to
> the user B which for me is serious security issue.
>
> --
> Arkadiusz Mi=B6kiewicz PLD/Linux Team
> arekm / maven.pl http://ftp.pld-linux.org/
>
>
> ------------------------------------------------------------ ---------
> The official User-To-User support forum of the Apache HTTP Server Project=
..
> See for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>

--000e0cd761d04d0538047730a80d
Content-Type: text/html; charset=ISO-8859-2
Content-Transfer-Encoding: quoted-printable

Read the mode_cache directive on the apache site and you will find your ans=
wer
=A0

Re: make mod_cache not cache cookies but cache contents

--000e0cd59be0ff6ddd047730b19e
Content-Type: text/plain; charset=ISO-8859-2
Content-Transfer-Encoding: quoted-printable

Also did you try setting the Cache header to no-cache on the apllication
side for the cookies?


2009/10/31 Igor Cicimov

> Read the mode_cache directive on the apache site and you will find your
> answer
>
>
> 2009/10/31 Arkadiusz Mi=B6kiewicz
>
>>
>> Hi,
>>
>> Is there a way to forbid caching cookies from application level (let say
>> php
>> or mod_perl level) by mod_cache? I know method via apache config but
>> trying
>> to find one via application level. Of course I would like the rest
>> (bodies)
>> to be actually cached but not cookies itself.
>>
>> mod_cache from 2.2.14 is doing crazy things like leaking user A cookie t=
o
>> the user B which for me is serious security issue.
>>
>> --
>> Arkadiusz Mi=B6kiewicz PLD/Linux Team
>> arekm / maven.pl http://ftp.pld-linux.org/
>>
>>
>> ------------------------------------------------------------ ---------
>> The official User-To-User support forum of the Apache HTTP Server Projec=
t.
>> See for more info.
>> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>> " from the digest: users-digest-unsubscribe@httpd.apache.org
>> For additional commands, e-mail: users-help@httpd.apache.org
>>
>>
>

--000e0cd59be0ff6ddd047730b19e
Content-Type: text/html; charset=ISO-8859-2
Content-Transfer-Encoding: quoted-printable

Also did you try setting the Cache header to no-cache on the apllication si=
de for the cookies?

Re: make mod_cache not cache cookies but cache contents from application side

Igor Cicimov wrote:

> Also did you try setting the Cache header to no-cache on the apllication
> side for the cookies?

This will prevent caching anything. I would like only cookies to be not
cached while the body of the request to be actually cached.

--
Arkadiusz Miśkiewicz PLD/Linux Team
arekm / maven.pl http://ftp.pld-linux.org/


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org