Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using nginx as a reverse proxy to serve a https-only site. So I want the cookies for this site flagged as secure. But the backend server is an http one so it won't set the secure flag to its cookies. How can I modify the Set-Cookie header in response to add a secure flag?

share|improve this question
Such an override is currently not possible, but there is an issue/ticket about proxy_cookie_secure: However it is not yet implemented (and the issue is old). – rugk May 15 at 23:13
up vote 2 down vote accepted

You might be able to get your nginx proxy modify the cookies created by the backend and set the secure flag - for inspiration see How to rewrite the domain part of Set-Cookie in a nginx reverse proxy?.

However I'd imagine that getting whatever is creating the cookie on the backend to set the secure flag is going to be a better solution. How you do that is another story (or question :).

share|improve this answer
It might help you to set the X-Forwarded-Proto header and make sure it is interpreted by your application. This is a common technique and also enables mixed http/https applications to react properly based on the protocol. – Lukas Apr 8 '13 at 17:17

Asked and answered over on SO. See SO for nginx example for Tomcat7:

share|improve this answer

I use the following nginx config code:

# make cookie secure (case sensitive)
proxy_cookie_domain ~(?P<secure_domain>([-0-9a-z]+\.)?[-0-9a-z]+\.[a-z]+)$ "$secure_domain; secure";

Instead of the regex to make this dynamical you can of course use the FQDN.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.