Set multiple cookies in Apache

Question

I'm trying to set two cookies in Apache (2.2), using mod_header, like so:

Header set Set-Cookie "poodle=noodle;path=/;Secure;HttpOnly;Expires=Wed, Jan 01 2020 2:02:02 GMT"
Header set Set-Cookie "tweedle=puddle;path=/;Secure;HttpOnly;Expires=Wed, Jan 01 2020 2:02:02 GMT"

But only the last cookie is being sent to the browser. I've done some searching, but only found people having this problem with no solution. I've tried combining them into one:

Header set Set-Cookie "poodle=noodle;tweedle=puddle;path=/;Secure;HttpOnly;Expires=Wed, Jan 01 2020 2:02:02 GMT"

Same problem. Do I need to use "Header append" instead? Any examples would be appreciated.

Answer 1

I would use mod_rewrite with the cookie flag the syntax is:

 [CO=NAME:VALUE:DOMAIN:lifetime:path:secure:httponly] 

So you want something similar to:

RewriteEngine On
RewriteRule .* -  [CO=poodle:noodle:example.com:0:/:true:true]
RewriteRule .* -  [CO=tweedle:puddle:example.com:0:/:true:true]

Answer 2

According to the Apache manual http://httpd.apache.org/docs/current/mod/mod_headers.html#header you should use append:

Header append Set-Cookie "poodle=noodle;path=/;Secure;HttpOnly;Expires=Wed, Jan 01 2020 2:02:02 GMT"
Header append Set-Cookie "tweedle=puddle;path=/;Secure;HttpOnly;Expires=Wed, Jan 01 2020 2:02:02 GMT"

or according to HTTP use comma to separate multiple values:

Header append Set-Cookie "poodle=noodle;path=/;Secure;HttpOnly;Expires=Wed, Jan 01 2020 2:02:02 GMT, tweedle=puddle;path=/;Secure;HttpOnly;Expires=Wed, Jan 01 2020 2:02:02 GMT"

or use Header add if you want avoid comma separated cookies in one header to follow suggestions in RFC 6265 section 3 (as noted by @SteveC):

Header add Set-Cookie "poodle=noodle;path=/;Secure;HttpOnly;Expires=Wed, Jan 01 2020 2:02:02 GMT"
Header add Set-Cookie "tweedle=puddle;path=/;Secure;HttpOnly;Expires=Wed, Jan 01 2020 2:02:02 GMT"