Secure cookies over reverse proxy with https

The following configuration properly produces secure cookies, however

var config = require(configPath),
    express = require('express'),
    cookieParser = require('cookie-parser'),
    session = require('express-session'),
    mongoStore = require('connect-mongo')(session),
    csrf = require('csurf'),
    ....
    sessionConfig = {
      // according to https://github.com/expressjs/session#resave
      // see "How do I know if this is necessary for my store?"
      resave: false,
      saveUninitialized: true,
      secret: config.cryptoKey,
      store: new mongoStore({ url: config.mongodb.uri }),
      cookie: {}
    };

app.use(cookieParser(config.cryptoKey));
if (node_env === "prod") {
    app.set('trust proxy', 1);
    sessionConfig.cookie.secure = true;
    logger.info("using secure cookies");
}
app.use(session(sessionConfig));

I’m getting a new sessionID for every subsequent request fired during a pageload. My application is sitting behind apache which acts as a reverse proxy and has https, the application itself is running on http.

This is not the case if I skip setting sessionConfig.cookie.secure = true; or setting sessionConfig.cookie.secure = false; and the same sessionID is assigned to every request during single or multiple pageloads while I’m firing requests from the same browser instance.

Do you have any idea why I’m getting new sessionID for every request made in a single pageload, is this the intended behavior?

[dougwilson]

Hi @akoskm, your issue is you have not finished standard reverse proxy configuration. Googling around for Apache setup information, it looks like you need to add RequestHeader set X-Forwarded-Proto "https" to your SSL virtual host declaration.

[nagman]

@dougwilson Thanks man!!! In my case, I had to set this header on both Apache and Nginx because my project looks like this: [Apache]===>[Docker (Nginx)===>(Express)]