<p>I'm not sure I'm understanding 100% what you're trying to do, but by preventing the <code>Set-Cookie</code> header, aren't you essentially blocking any cookies from being set in your browser?</p>

<p>All of Craft's authentication is cookie based, so it's not surprising that trying to login to the control panel doesn't work.</p>

CC BY-SA 3.0
2014-07-31T04:31:53.610Z
That should have said "change" I will update it. I want to change the name so maybe it's "myAppSessionId"..
Jason McCallister
CC BY-SA 3.0
2014-07-31T04:48:05.547Z
Figured as much... that's currently not possible without a hack, but just trying to understand how changing that would help your situation.
Brad Bell
CC BY-SA 3.0
2014-07-31T04:29:29.633Z
2014-07-31T04:29:29.633Z
Brad Bell
<p>I am running a Nginx server and tried to hide the 'Set-Cookie' parameter from the HTTP header output when using <code>curl -I hostname.com</code> - I applied the Nginx configuration using: </p>

<p><code>proxy_hide_header Set-Cookie;</code></p>

<p>Using this worked as intended - until I noticed that any request to login to the control panel simply resulted in reloading the admin login page.</p>

<p>Is there a way to change or hide this that still allows users to login to the control panel?</p>

<config><control-panel><security><nginx>
Change the name of 'CraftSessionId' from HTTP header requests?
# Change the name of 'CraftSessionId' from HTTP header requests?

(Asked by: username_0 on 2014-07-31)

I am running a Nginx server and tried to hide the 'Set-Cookie' parameter from the HTTP header output when using `curl -I hostname.com` - I applied the Nginx configuration using:

`proxy_hide_header Set-Cookie;`

Using this worked as intended - until I noticed that any request to login to the control panel simply resulted in reloading the admin login page.

Is there a way to change or hide this that still allows users to login to the control panel?

**Tags:** config, control-panel, security, nginx


---

## 1 answers

### Answer by username_1 on 2014-07-31. Score: 1

I'm not sure I'm understanding 100% what you're trying to do, but by preventing the `Set-Cookie` header, aren't you essentially blocking any cookies from being set in your browser?

All of Craft's authentication is cookie based, so it's not surprising that trying to login to the control panel doesn't work.

> **Comments:**
> **username_0**: That should have said "change" I will update it. I want to change the name so maybe it's "myAppSessionId"..  
> **username_1**: Figured as much... that's currently not possible without a hack, but just trying to understand how changing that would help your situation.  

---

