Secure Flag cannot be set for unproxied localhost

Browsers consider localhost to be a secure origin (i.e. see https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies).

express-session does not. This means for my local configuration, I need to disable the Secure flag, which has other repercussions:

• I cannot set the Cookie Name to __Host-sid and need to make a special-case development exception
• I cannot use CORS Requests to localhost with Cookies, since non-secure Cookies aren’t sent, even with SameSite=none

I understand that this is the result of express-session trying to be smart and trying to prevent sending cookies over insecure connections.

The code causing this is in index.js:

if (req.session.cookie.secure && !issecure(req, trustProxy)) {

I don’t think that issecure can reliably detect if the connection attempt is secure or not for the localhost case.

I see two possible solutions:

• Allow disabling the issecure check and unconditionally set the cookie (this is what I actually want, because otherwise it just silently fails)
• Potentially inspect the origin-header for localhost as a heuristic, this (should?) remain unchanged through proxies too

[dougwilson]

Yes, you have to use Object.defineProperty as it is a getter (just how Javascript works for getters). I can understand that. So it sounds like then just wait for me to research the current state of the specs to see what the need is for server side checking. I don’t want to quickly add a switch when it turns out checking is not needed, then need to go though depreciation cycles to relove it, etc. Just a bit of checking up front will keep this module’s API options frlm growing to an even bigger spaghetti than it already is 😂

[timbotnik]

Looks like Chromium and Firefox both allow usage of secure cookies on localhost:

• https://bugs.chromium.org/p/chromium/issues/detail?id=1056543
• https://bugzilla.mozilla.org/show_bug.cgi?id=1618113

While Safari still does not and looks to be considered a bug:

• https://bugs.webkit.org/show_bug.cgi?id=218980