security config_error ai_generated true

Session cookie not marked Secure when served over HTTPS behind reverse proxy

ID: security/session-cookie-secure-flag-missing-behind-proxy

Also available as: JSON · Markdown · 中文
90%Fix Rate
87%Confidence
1Evidence
2024-01-10First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Nginx 1.25 active — — —
Apache 2.4 active — — —
HAProxy 2.8 active — — —

Root Cause

The application server only sees HTTP from the reverse proxy (TLS termination at proxy) and therefore does not set the Secure attribute on session cookies, exposing them to interception over plain HTTP.

generic

中文

应用服务器只看到来自反向代理的HTTP（TLS在代理处终止），因此不会在会话cookie上设置Secure属性，导致cookie在纯HTTP下暴露于窃听风险。

Official Documentation

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie

Workarounds

  1. 95% success Configure the reverse proxy to forward the X-Forwarded-Proto header. For Nginx: proxy_set_header X-Forwarded-Proto $scheme; and in the app, trust the proxy and set secure cookies when this header is 'https'. 
    Configure the reverse proxy to forward the X-Forwarded-Proto header. For Nginx: proxy_set_header X-Forwarded-Proto $scheme; and in the app, trust the proxy and set secure cookies when this header is 'https'.
  2. 90% success Set the 'Secure' attribute in the application configuration file, e.g., in Django: SESSION_COOKIE_SECURE = True, but only when the environment is production. 
    Set the 'Secure' attribute in the application configuration file, e.g., in Django: SESSION_COOKIE_SECURE = True, but only when the environment is production.
  3. 80% success Use a proxy-level rewrite to add the Secure attribute to Set-Cookie headers. For Nginx, use the headers-more-nginx-module: more_set_headers 'Set-Cookie: $upstream_http_set_cookie; Secure' 
    Use a proxy-level rewrite to add the Secure attribute to Set-Cookie headers. For Nginx, use the headers-more-nginx-module: more_set_headers 'Set-Cookie: $upstream_http_set_cookie; Secure'

中文步骤

  1. 配置反向代理转发X-Forwarded-Proto头。对于Nginx：proxy_set_header X-Forwarded-Proto $scheme; 并在应用中信任代理，当此头为'https'时设置安全cookie。
  2. 在应用程序配置文件中设置'Secure'属性，例如在Django中：SESSION_COOKIE_SECURE = True，但仅在生产环境中。
  3. 使用代理级重写向Set-Cookie头添加Secure属性。对于Nginx，使用headers-more-nginx-module：more_set_headers 'Set-Cookie: $upstream_http_set_cookie; Secure'

Dead Ends

Common approaches that don't work:

  1. 50% fail

    Forcing HTTPS on the application server directly without configuring the proxy headers may cause redirect loops or break the proxy connection.

  2. 40% fail

    Removing the proxy and using direct TLS termination on the app server is often not feasible in existing infrastructure.

  3. 30% fail

    Simply setting the Secure flag unconditionally in code may break local development over HTTP.