Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using nginx as a reverse proxy to serve a https-only site. So I want the cookies for this site flagged as secure. But the backend server is an http one so it won't set the secure flag to its cookies. How can I modify the Set-Cookie header in response to add a secure flag?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You might be able to get your nginx proxy modify the cookies created by the backend and set the secure flag - for inspiration see How to rewrite the domain part of Set-Cookie in a nginx reverse proxy?.

However I'd imagine that getting whatever is creating the cookie on the backend to set the secure flag is going to be a better solution. How you do that is another story (or question :).

share|improve this answer
2  
It might help you to set the X-Forwarded-Proto header and make sure it is interpreted by your application. This is a common technique and also enables mixed http/https applications to react properly based on the protocol. –  Lukas Apr 8 '13 at 17:17

Asked and answered over on SO. See SO for nginx example for Tomcat7:

http://stackoverflow.com/questions/19916906/nginx-managed-ssl-with-tomcat-7/24099526#24099526

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.