Add Secure to SameSite=None cookies on nginx
Why it matters
Browsers reject a cookie marked SameSite=None unless it also has Secure, so this cookie is silently dropped and whatever depends on it, such as an embedded widget or a login, fails. Add Secure, or use SameSite=Lax if the cookie is not needed in cross-site requests.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Stage 1: confirm the site runs fully on https.
- Stage 2: if nginx proxies to the application, add Secure to cookies it passes (nginx 1.19.3 or later).
- nginx applies only the first proxy_cookie_flags line that matches a cookie. If you already have a line for this cookie, add secure to that line (keep samesite=none); otherwise the catch-all ~ line covers it, placed after any named lines. Run sudo nginx -t, reload and test the flow that uses the cookie.
nginx
# if this cookie already has a line of its own, add secure there # proxy_cookie_flags widget_cookie_name secure samesite=none; # otherwise the catch-all covers it; keep it after every named line proxy_cookie_flags ~ secure;
Related
Scan your domain to see whether this applies to you.