Secure Cookies behind an SSL load balancer

Hi. When I set a cookie with the secure field as true KTOR throw this exception:

java.lang.IllegalArgumentException: You should set secure cookie only via secure transport (HTTPS)
	at io.ktor.response.ResponseCookies.append(ResponseCookies.kt:11)
	at io.ktor.response.ResponseCookies.append(ResponseCookies.kt:26)
	at io.ktor.response.ResponseCookies.append$default(ResponseCookies.kt:25)

I get that this is per spec, however I am running KTOR behind a load balancer that strips away HTTPS. Are there any solutions? I think this is a pretty common scenario. I think I will run into a similar issue with the HSTS headers.

Thank you 😃

[marshallpierce]

Adding the feature (XForwardedHeadersSupport) does allow setting cookies with “secure” enabled.

However, I think this check in ResponseCookies is a mistake. What if I’m behind a proxy (or a chain of proxies) that doesn’t set the necessary headers? Even when the headers are being sent, why should I have to enable inspection of some headers I otherwise don’t care about at all to get past this check? It’s very clearly my intent as a developer to set the Secure flag, otherwise I wouldn’t have written the code to set it. Just let me do it.

It’s just a hurdle with little value: now I have to go through the hassle of figuring out exactly which headers the proxies do send, adjusting the headers inspected in the feature (I’m assuming that’s why the config uses arrayListOf – so we can modify it), etc. I could see maybe logging a warning the first time it happens, but even that would get annoying quickly. I think the check should be removed in its entirety.

[RamenSea]

Sorry forgot to confirm this fixed the issue.