Apache Module mod_session_cookie

The session modules make use of HTTP cookies, and as such can fall victim to Cross Site Scripting attacks, or expose potentially private information to clients. Please ensure that the relevant risks have been taken into account before enabling the session functionality on your server.

provides support for the storage of user sessions on the remote browser within HTTP cookies.mod_session

Using cookies to store a session removes the need for the server or a group of servers to store the session locally, or collaborate to share a session, and can be useful for high traffic environments where a server based session might be too resource intensive.

If session privacy is required, the

module can be used to encrypt the contents of the session before writing the session to the client.modsessioncrypto

For more details on the session interface, see the documentation for the

For more examples on how the session can be configured to be read from and written to by a CGI application, see the

For documentation on how the session can be used to store username and password details, see the

An optional list of cookie attributes can be specified, as per the example below. These attributes are inserted into the cookie as is, and are not interpreted by Apache. Ensure that your attributes are defined correctly as per the cookie specification.

Session On SessionCookieName session path=/private;domain=example.com;httponly;secure;version=1;

In a reverse proxy situation where the Apache server acts as a server frontend for a backend origin server, revealing the contents of the session cookie to the backend could be a potential privacy violation. When set to on, the session cookie will be removed from the incoming HTTP headers.

Modules | Directives | FAQ | Glossary | Sitemap

Apache HTTP Server Version 2.4