I'm using nginx as a reverse proxy to serve a https-only site. So I want the cookies for this site flagged as secure. But the backend server is an http one so it won't set the secure flag to its cookies. How can I modify the Set-Cookie header in response to add a secure flag?


3 Answers 3


You might be able to get your nginx proxy modify the cookies created by the backend and set the secure flag - for inspiration see How to rewrite the domain part of Set-Cookie in a nginx reverse proxy?.

However I'd imagine that getting whatever is creating the cookie on the backend to set the secure flag is going to be a better solution. How you do that is another story (or question :).

  • 5
    It might help you to set the X-Forwarded-Proto header and make sure it is interpreted by your application. This is a common technique and also enables mixed http/https applications to react properly based on the protocol.
    – Lukas
    Apr 8, 2013 at 17:17

I use the following nginx config code:

# make cookie secure (case sensitive)
proxy_cookie_domain ~(?P<secure_domain>([-0-9a-z]+\.)?[-0-9a-z]+\.[a-z]+)$ "$secure_domain; secure";

Instead of the regex to make this dynamical you can of course use the FQDN.

  • Is this just on response or both request and response. When the client sends a request with the secure flag set does nginx strip it so the web server doesn't complain?
    – Tigran
    Aug 25, 2018 at 16:04
  • Clients do not send back the secure flag in the Cookie header.
    – r_3
    Sep 7, 2018 at 11:26

This help me:

proxy_cookie_path / "/; secure";

See http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_path

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .