I am new to Nginx server. recently started working nginx project. I have task to set security headers through nginx.conf file. I set some header correctly but not able to set for Set-cookie. My requirement is, in response header Set-Cookie should have Secure and HTTPOnly attributes. Added below two directives in nginx.conf file

set_cookie_flag HttpOnly Secure;
proxy_cookie_path / "/; HTTPOnly; Secure";

Tried with each one and both also, but only HttpOnly coming. Please look into below for my conf file snippet

server { listen 80; server_tokens off; server_name getenv "PROXY_URL" }}; set_cookie_flag HttpOnly Secure; proxy_cookie_path / "/; HTTPOnly; Secure"; include routes;
}

Please help me, what I need to add here or anything I missed.

Thanks in Advance.

4 Answers

Remember to do add SameSite=none as well:

location /foo { proxy_pass proxy_cookie_path /foo "/; SameSite=None; HTTPOnly; Secure";
}

Sources:

2

I had a look at this article

In order to use set_cookie_flag HttpOnly Secure; you need to build nginx from sources and while adding the path of the secure cookie additional module --add-module=/path/to/nginx_cookie_flag_module.

If you don't want to build nginx from sources, you can add only proxy_cookie_path / "/; HTTPOnly; Secure"; to your configuration.

Following the article, it should be enough.

1

Another alternative option is to:

1. Go to this directory: "/etc/nginx/conf.d".

2. Create an empty text file by the name of ssl.conf (As you see There is example_ssl.conf there).

3. Add the below syntax in ssl.conf (or default.conf):

   server { proxy_cookie_path / "/; HTTPOnly; Secure";}

   note that the whole path "/" will be replaced. For example the directive "proxy_cookie_path /two/ /;" will rewrite “path=/two/one/uri/” to “path=/one/uri/”.

4. Open /etc/nginx/nginx.conf and add following command:

   include /etc/nginx/conf.d/ssl.conf

5. Restart the Nginx to see the results.

1

The flag is only supported by nginx Plus

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy