6

I'm using Nginx as a reverse proxy server. Is it possible to Remove the "secure" flag to the cookies somehow using Nginx? Modifying the path is possible so I guess it's also possible to modify cookie.

1
  • Did you find solution? I need to remove Secure flag also...
    – yumaa
    Commented Apr 18, 2019 at 14:00

3 Answers 3

3

An imperfect method:

proxy_cookie_path "~*^(.*?)$" $1\nX-User-Value:;
4
  • 3
    Please add some explanation to your answer such that others can learn from it
    – Nico Haase
    Commented Apr 17, 2020 at 11:15
  • While this code may solve the question, including an explanation of how and why this solves the problem would really help to improve the quality of your post, and probably result in more up-votes. Remember that you are answering the question for readers in the future, not just the person asking now. Please edit your answer to add explanations and give an indication of what limitations and assumptions apply. Commented Apr 17, 2020 at 15:22
  • Here's how this works in case anyone is wondering: The directive matches any path using a regex, and the replacement keeps the path as-is, but causes everything following it to be moved into a new header named X-User-Value. The Secure will be discarded, as long as it is placed after the path in the original header.
    – p4m
    Commented Apr 24, 2020 at 14:57
  • You understand very thoroughly. It can only be used in the development environment, but not in the production environment !!!
    – wangcj
    Commented Apr 27, 2020 at 3:10
2

I know this is quite old question, but there is no answer here and I couldn't find fine solution for the same problem.

So I forked nginx_cookie_flag_module module and changed it to nginx_unsecure_cookie_module: https://github.com/yumauri/nginx_unsecure_cookie_module

I'm frontend developer, my C/C++ knowledges are super low, but looks like it is working in my tests :) So I reckon it is good enough for development reasons.

2

Since nginx 1.19.3 you can use http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_flags. For example:

proxy_cookie_flags some_cookie nosecure;

To remove the Secure flag from all cookies:

proxy_cookie_flags ~ nosecure;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.