I'm using Nginx as a reverse proxy server. Is it possible to Remove the "secure" flag to the cookies somehow using Nginx? Modifying the path is possible so I guess it's also possible to modify cookie.
3 Answers
An imperfect method:
proxy_cookie_path "~*^(.*?)$" $1\nX-User-Value:;
-
3Please add some explanation to your answer such that others can learn from it Commented Apr 17, 2020 at 11:15
-
While this code may solve the question, including an explanation of how and why this solves the problem would really help to improve the quality of your post, and probably result in more up-votes. Remember that you are answering the question for readers in the future, not just the person asking now. Please edit your answer to add explanations and give an indication of what limitations and assumptions apply. Commented Apr 17, 2020 at 15:22
-
Here's how this works in case anyone is wondering: The directive matches any path using a regex, and the replacement keeps the path as-is, but causes everything following it to be moved into a new header named
X-User-Value
. The Secure will be discarded, as long as it is placed after the path in the original header.– p4mCommented Apr 24, 2020 at 14:57 -
You understand very thoroughly. It can only be used in the development environment, but not in the production environment !!!– wangcjCommented Apr 27, 2020 at 3:10
I know this is quite old question, but there is no answer here and I couldn't find fine solution for the same problem.
So I forked nginx_cookie_flag_module
module and changed it to nginx_unsecure_cookie_module
:
https://github.com/yumauri/nginx_unsecure_cookie_module
I'm frontend developer, my C/C++ knowledges are super low, but looks like it is working in my tests :) So I reckon it is good enough for development reasons.
Since nginx 1.19.3 you can use http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_flags. For example:
proxy_cookie_flags some_cookie nosecure;
To remove the Secure
flag from all cookies:
proxy_cookie_flags ~ nosecure;