nginx add_header Set-Cookie expires not working

Question

I am trying to set up an nginx server that sets certain parameters in a cookie when hit on a certain location.

I have the following configuration that puts the parameters in the cookie but the expiration does not work. This is my configuration:

server {
    listen       8800 default_server;
    include /etc/nginx/default.d/*.conf;

    server_name test.net;

    location /initial {
            add_header Set-Cookie lcid=1043;
            add_header Set-Cookie expires=60;
    }
}

Based on my understanding, after 60 seconds of setting this cookie up the cookie should expire and get removed. However, it persists.

Is there anything wrong with this configuration?

Any help would be appreciated, Thanks!

score 10 · Answer 1 · edited Dec 21 '19 at 22:20

The above configuration will result in two Set-Cookie headers set in response sent to the client.

Set-Cookie: lcid=1043
Set-Cookie: expires=60

"Expires" is a cookie attribute which should be present in the header where you are setting the cookie name and value. Also one more point to note here is that the Expires attribute of the cookie only takes a fixed time stamp (Ex : Expires=Wed, 21 Oct 2015 07:28:00 GMT) and not the duration. If you need to specify the validity of the cookie in terms of duration then you need to set the Max-Age attribute instead of Expires.

So you need to change your configuration to have only one add_header directive which looks like below

add_header Set-Cookie "lcid=1043; Max-Age=60";

This will make sure that client receives only one Set-Cookie header in the response with the appropriate expiry value set as specified in the Max-Age attribute of the cookie.

I appreciate the response - I will modify the code later today and update this post — penguin, Apr 18 '19 at 18:17

score -1 · Answer 2 · answered Nov 10 '20 at 18:57

Found out that this can be done upstream directly from Wordpress.

Add the following lines to the top of wp-config.php:

@ini_set('session.cookie_httponly', true);
@ini_set('session.cookie_secure', true);
@ini_set('session.use_only_cookies', true);

Then restart Wordpress.

nginx add_header Set-Cookie expires not working

2 Answers2