# Session cookie not marked Secure when served over HTTPS behind reverse proxy

- **ID:** `security/session-cookie-secure-flag-missing-behind-proxy`
- **Domain:** security
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

The application server only sees HTTP from the reverse proxy (TLS termination at proxy) and therefore does not set the Secure attribute on session cookies, exposing them to interception over plain HTTP.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Nginx 1.25 | active | — | — |
| Apache 2.4 | active | — | — |
| HAProxy 2.8 | active | — | — |

## Workarounds

1. **Configure the reverse proxy to forward the X-Forwarded-Proto header. For Nginx: proxy_set_header X-Forwarded-Proto $scheme; and in the app, trust the proxy and set secure cookies when this header is 'https'.** (95% success)
   ```
   Configure the reverse proxy to forward the X-Forwarded-Proto header. For Nginx: proxy_set_header X-Forwarded-Proto $scheme; and in the app, trust the proxy and set secure cookies when this header is 'https'.
   ```
2. **Set the 'Secure' attribute in the application configuration file, e.g., in Django: SESSION_COOKIE_SECURE = True, but only when the environment is production.** (90% success)
   ```
   Set the 'Secure' attribute in the application configuration file, e.g., in Django: SESSION_COOKIE_SECURE = True, but only when the environment is production.
   ```
3. **Use a proxy-level rewrite to add the Secure attribute to Set-Cookie headers. For Nginx, use the headers-more-nginx-module: more_set_headers 'Set-Cookie: $upstream_http_set_cookie; Secure'** (80% success)
   ```
   Use a proxy-level rewrite to add the Secure attribute to Set-Cookie headers. For Nginx, use the headers-more-nginx-module: more_set_headers 'Set-Cookie: $upstream_http_set_cookie; Secure'
   ```

## Dead Ends

- **** — Forcing HTTPS on the application server directly without configuring the proxy headers may cause redirect loops or break the proxy connection. (50% fail)
- **** — Removing the proxy and using direct TLS termination on the app server is often not feasible in existing infrastructure. (40% fail)
- **** — Simply setting the Secure flag unconditionally in code may break local development over HTTP. (30% fail)