0

The intended production environment will be utilising an AWS EKS nginx ingress controller so it would be preferable to not require a bespoke build of nginx.

For local development the docker image https://hub.docker.com/r/lautre/nginx-cookie-flag has been installed, which should have the cookie-flag module pre-installed. Both methods suggested in the example at https://geekflare.com/httponly-secure-cookie-nginx/ have been tried, but don't seem to be working:

http { 
 ...
 proxy_cookie_path / "/; HTTPOnly;   Secure";
 ...
}

And

server {
 ...
 proxy_cookie_path / "/; HTTPOnly;   Secure";
 ...
}

Specifically the token "atlassian.xsrf.token" is never signed as HttpOnly, this is being generated from a jira plugin within the web app https://confluence.atlassian.com/adminjiracloud/using-the-issue-collector-776636529.html

Questions:

  1. Most examples found are the same as that above, is the external module the only solution available?
  2. Does the nginx plus version have this module baked in, allowing to reference by default?
djamey
  • 11
  • 1
  • 4

2 Answers2

0

You can also solve this using the add_header directive and manually setting the cookie

Example

location / {
    add_header Set-Cookie 'MyCookie=SomeValue; Path=/; HttpOnly; Secure';
    proxy_pass http://1.2.3.4;
}
Robert Teller
  • 21
  • 1
  • thank you for your suggestion, unfortunately, this did not solve my particular issue. It might be due to the source of the cookie, – djamey May 07 '20 at 13:48
0

No need to compile nginx, just use:

proxy_cookie_flags ~ secure httponly;

You might need to update your version of nginx, as this wasn't yet available as of nginx 1.12. I think it was added in 1.19.

Velizar Hristov
  • 662
  • 2
  • 10
  • 23