Secure Flag cannot be set for unproxied localhost
See original GitHub issueBrowsers consider localhost to be a secure origin (i.e. see https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies).
express-session does not. This means for my local configuration, I need to disable the Secure flag, which has other repercussions:
- I cannot set the Cookie Name to
__Host-sid
and need to make a special-case development exception - I cannot use CORS Requests to localhost with Cookies, since non-secure Cookies aren’t sent, even with SameSite=none
I understand that this is the result of express-session trying to be smart and trying to prevent sending cookies over insecure connections.
The code causing this is in index.js:
if (req.session.cookie.secure && !issecure(req, trustProxy)) {
I don’t think that issecure can reliably detect if the connection attempt is secure or not for the localhost case.
I see two possible solutions:
- Allow disabling the
issecure
check and unconditionally set the cookie (this is what I actually want, because otherwise it just silently fails) - Potentially inspect the origin-header for
localhost
as a heuristic, this (should?) remain unchanged through proxies too
Issue Analytics
- State:
- Created 2 years ago
- Reactions:5
- Comments:8 (4 by maintainers)
Top Results From Across the Web
Cross-Site Cookies Will Now Be Rejected on localhost ...
The new rule demands that all cross-site cookies set in a browser have to be set with Secure attribute if they are to...
Read more >How to handle secure cookie in localhost - java - Stack Overflow
You can go to this site and generate a self-signed certificate. This can then be placed either on the web server or on...
Read more >Add support for removing the 'secure' attribute on proxied ...
The console shows the cookie secure flag has been removed, but the browser still receives the cookie with the secure flag set.
Read more >How to Configure Outbound HTTP and HTTPS Proxy for your ...
Solution. Basic Configuration. HTTP(S) Outbound Proxy support is configured in Atlassian applications by passing certain system properties to ...
Read more >When to use HTTPS for local development - web.dev
Secure cookies are set only on HTTPS, but not on http://localhost for all browsers. And because SameSite:none and __Host also require the ...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Yes, you have to use
Object.defineProperty
as it is a getter (just how Javascript works for getters). I can understand that. So it sounds like then just wait for me to research the current state of the specs to see what the need is for server side checking. I don’t want to quickly add a switch when it turns out checking is not needed, then need to go though depreciation cycles to relove it, etc. Just a bit of checking up front will keep this module’s API options frlm growing to an even bigger spaghetti than it already is 😂Looks like Chromium and Firefox both allow usage of secure cookies on localhost:
While Safari still does not and looks to be considered a bug: