For the sake of development I need to make NGINX drop "Secure" flag from cookie headers.

Set-Cookie:XSRF-TOKEN=zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzz; Path=/; Secure

should become

Set-Cookie:XSRF-TOKEN=zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzz; Path=/;

For each Set-Cookie header. I am creating a reverse-proxy configuration to decouple development server from the UI and since upstream is running behind HTTPS while NGINX is running on plain HTTP, browser refuses to send cookies back.

  • 1
    Should be easier to get an ssl certificate.
    – Alexey Ten
    May 31 '17 at 14:49
  • You're right, this is what I'm doing now, but my internal perfectionist told me to ask this question :)
    – Juriy
    May 31 '17 at 15:03

I know this is quite old question, but there is no answer here and I couldn't find fine solution for the same problem.

So I forked nginx_cookie_flag_module module and changed it to nginx_unsecure_cookie_module: https://github.com/yumauri/nginx_unsecure_cookie_module

I'm frontend developer, my C/C++ knowledges are super low, but looks like it is working in my tests :) So I reckon it is good enough for development reasons.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.