Add the Secure flag to cookies on nginx
Why it matters
A cookie without Secure is also sent over plain http, where anyone on the network can read it and, for a session cookie, take over the visitor's account. Secure keeps it to HTTPS connections.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Stage 1: make sure the whole site works over https and http redirects to https.
- Stage 2: if nginx proxies to the application (proxy_pass), the ~ line below adds Secure to every cookie it passes (nginx 1.19.3 or later). Cookies set by PHP-FPM through fastcgi_pass are not covered; fix those in php.ini.
- nginx applies only the first proxy_cookie_flags line that matches a cookie. Give each named cookie one line with all its flags, including secure, before the catch-all ~ line, as in the snippet. samesite=lax replaces a SameSite value the cookie already has, so write the value it should end up with (samesite=strict to keep Strict). Run sudo nginx -t, reload, and test logging in.
nginx
# in the server or location block that proxies to the application. # Named cookies first, each with all of its flags (only if you need # a line for a specific cookie): # proxy_cookie_flags session_cookie_name secure httponly samesite=lax; # then the catch-all: proxy_cookie_flags ~ secure;
Related
Scan your domain to see whether this applies to you.