{
  "id": "security/session-cookie-secure-flag-missing-behind-proxy",
  "signature": "Session cookie not marked Secure when served over HTTPS behind reverse proxy",
  "signature_zh": "在反向代理后通过HTTPS提供服务时，会话cookie未标记为Secure",
  "regex": "Set-Cookie.*(?!.*Secure)|cookie.*not.*secure|Secure flag.*missing",
  "domain": "security",
  "category": "config_error",
  "subcategory": null,
  "root_cause": "The application server only sees HTTP from the reverse proxy (TLS termination at proxy) and therefore does not set the Secure attribute on session cookies, exposing them to interception over plain HTTP.",
  "root_cause_type": "generic",
  "root_cause_zh": "应用服务器只看到来自反向代理的HTTP（TLS在代理处终止），因此不会在会话cookie上设置Secure属性，导致cookie在纯HTTP下暴露于窃听风险。",
  "versions": [
    {
      "version": "Nginx 1.25",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Apache 2.4",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "HAProxy 2.8",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Forcing HTTPS on the application server directly without configuring the proxy headers may cause redirect loops or break the proxy connection.",
      "fail_rate": 0.5,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Removing the proxy and using direct TLS termination on the app server is often not feasible in existing infrastructure.",
      "fail_rate": 0.4,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Simply setting the Secure flag unconditionally in code may break local development over HTTP.",
      "fail_rate": 0.3,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Configure the reverse proxy to forward the X-Forwarded-Proto header. For Nginx: proxy_set_header X-Forwarded-Proto $scheme; and in the app, trust the proxy and set secure cookies when this header is 'https'.",
      "success_rate": 0.95,
      "how": "Configure the reverse proxy to forward the X-Forwarded-Proto header. For Nginx: proxy_set_header X-Forwarded-Proto $scheme; and in the app, trust the proxy and set secure cookies when this header is 'https'.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Set the 'Secure' attribute in the application configuration file, e.g., in Django: SESSION_COOKIE_SECURE = True, but only when the environment is production.",
      "success_rate": 0.9,
      "how": "Set the 'Secure' attribute in the application configuration file, e.g., in Django: SESSION_COOKIE_SECURE = True, but only when the environment is production.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use a proxy-level rewrite to add the Secure attribute to Set-Cookie headers. For Nginx, use the headers-more-nginx-module: more_set_headers 'Set-Cookie: $upstream_http_set_cookie; Secure'",
      "success_rate": 0.8,
      "how": "Use a proxy-level rewrite to add the Secure attribute to Set-Cookie headers. For Nginx, use the headers-more-nginx-module: more_set_headers 'Set-Cookie: $upstream_http_set_cookie; Secure'",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "配置反向代理转发X-Forwarded-Proto头。对于Nginx：proxy_set_header X-Forwarded-Proto $scheme; 并在应用中信任代理，当此头为'https'时设置安全cookie。",
    "在应用程序配置文件中设置'Secure'属性，例如在Django中：SESSION_COOKIE_SECURE = True，但仅在生产环境中。",
    "使用代理级重写向Set-Cookie头添加Secure属性。对于Nginx，使用headers-more-nginx-module：more_set_headers 'Set-Cookie: $upstream_http_set_cookie; Secure'"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.87,
  "fix_success_rate": 0.9,
  "resolvable": "true",
  "first_seen": "2024-01-10",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}