I'm using nginx as a reverse proxy to serve a https-only site. So I want the cookies for this site flagged as secure. But the backend server is an http one so it won't set the secure flag to its cookies. How can I modify the Set-Cookie header in response to add a secure flag?


You might be able to get your nginx proxy modify the cookies created by the backend and set the secure flag - for inspiration see How to rewrite the domain part of Set-Cookie in a nginx reverse proxy?.

However I'd imagine that getting whatever is creating the cookie on the backend to set the secure flag is going to be a better solution. How you do that is another story (or question :).

  • 4
    It might help you to set the X-Forwarded-Proto header and make sure it is interpreted by your application. This is a common technique and also enables mixed http/https applications to react properly based on the protocol. – Lukas Apr 8 '13 at 17:17

I use the following nginx config code:

# make cookie secure (case sensitive)
proxy_cookie_domain ~(?P<secure_domain>([-0-9a-z]+\.)?[-0-9a-z]+\.[a-z]+)$ "$secure_domain; secure";

Instead of the regex to make this dynamical you can of course use the FQDN.

  • Is this just on response or both request and response. When the client sends a request with the secure flag set does nginx strip it so the web server doesn't complain? – Tigran Aug 25 '18 at 16:04
  • Clients do not send back the secure flag in the Cookie header. – r_3 Sep 7 '18 at 11:26

This help me:

proxy_cookie_path / "/; secure";

See http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_path

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.