unable to use secure cookies

I am trying to set secure cookies, it does not work at first try.

I am using

 secret: sessionSecret,
      resave: false,
      saveUninitialized: true,
      cookie: {
        secure: true,
        httpOnly: true,
        domain: 'beintoo.net',
        expires: expiryDate
      }

I found function issecure relying on req.connection.encrypted here but it seems not supported anymore, see https://github.com/expressjs/express/issues/1864

Any hint?

[dougwilson]

Ah, should be able to get proxy_set_header X-Forwarded-Proto https; added in there and it should be good to go?

[ghost]

I had some trouble with this as well. By turning on cookie: { secure: true }, proxy: true, app.set('trust proxy', true), and proxy_set_header X-Forwarded-Proto $scheme; in the nginx proxy, I’ve gotten HTTPS cookies to work.

Here’s a snip of my app:

app.set('trust proxy', true)
app.use(session({
    store: new RedisStore({
        pass: 'aaa',
    }),
    secret: 'aaa',
    proxy: true,
    resave: false,
    saveUninitialized: true,
    cookie: { secure: true }
    }))

And my nginx configuration:

# Snip of nginx proxy configuration

proxy_redirect off;
    proxy_http_version 1.1;
    proxy_pass http://127.0.0.1:port;
    proxy_set_header Host $host; 
    proxy_set_header X-Real-IP $remote_addr; 
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;