# Secure and httponly cookies

**URL:** <https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218>\
**Category:** NGINX\
**Created:** [March 7, 2016, 8:38pm UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218 "2016-03-07T20:38:23Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\
**Post date:** [March 7, 2016, 8:38pm UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/1 "2016-03-07T20:38:23Z")

</div>

Hi,

How to mark all the cookies from the backend servers as secure and  
httponly?

Is there some config in NGINX available for this?

Thanks,  
Krishna

Posted at Nginx Forum:

> **[secure and httponly cookies](https://forum.nginx.org/read.php?2,265137,265137#msg-265137)**
>
> Hi, How to mark all the cookies from the backend servers as secure and httponly? Is there some config in NGINX available for this? Thanks, Krishna

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 7, 2016, 8:47pm UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/2 "2016-03-07T20:47:44Z")

</div>

This isn’t really something you do on your web server but rather in your  
backend configuration (such as php.ini), etc.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 7, 2016, 8:55pm UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/3 "2016-03-07T20:55:19Z")

</div>

Thanks for the response.

Yes, i understand that. But here they dont create a secure or httponly  
cookie in the backend (webseal/ibm portal).

Earlier we were using ibm http server (IHS) and were adding these flags  
in  
the web server itself.

Now we are trying to replace IHS with nginx but not able to accomplish  
the  
same here.

Posted at Nginx Forum:

> **[Re: secure and httponly cookies](https://forum.nginx.org/read.php?2,265137,265140#msg-265140)**
>
> Hi, How to mark all the cookies from the backend servers as secure and httponly? Is there some config in NGINX available for this? Thanks, Krishna

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 7, 2016, 9:15pm UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/4 "2016-03-07T21:15:46Z")

</div>

Here, nginx is proxy passing the requests to webseal and webseal sends  
the  
response with cookies.  
We are trying to rewrite this cookie headers.  
Could you tell me more about LUA or some links where i can read about  
it?

Posted at Nginx Forum:

> **[Re: secure and httponly cookies](https://forum.nginx.org/read.php?2,265137,265142#msg-265142)**
>
> Hi, How to mark all the cookies from the backend servers as secure and httponly? Is there some config in NGINX available for this? Thanks, Krishna

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 7, 2016, 9:01pm UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/5 "2016-03-07T21:01:10Z")

</div>

Without knowing much about webseal (only simple googling), webseal  
really seems to be a very custom IBM product that does one thing:  
Integrate into Tivoli Access Manager - meaning they’ve very specific  
features (such as single sign-on) etc.  
nginx is a general webserver, it doesn’t hook into your backend system,  
usually you proxy some requests to it, or serve some files.

The only way I can think of, is by using LUA to rewrite the Set-Cookie  
headers, but it’s not really a nice solution.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 7, 2016, 9:37pm UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/6 "2016-03-07T21:37:24Z")

</div>

There’s a relevant resty library as well -

> **[GitHub - cloudflare/lua-resty-cookie: Lua library for HTTP cookie...](https://github.com/cloudflare/lua-resty-cookie)**
>
> Lua library for HTTP cookie manipulations for OpenResty/ngx\_lua - GitHub - cloudflare/lua-resty-cookie: Lua library for HTTP cookie manipulations for OpenResty/ngx\_lua

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 7, 2016, 10:16pm UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/7 "2016-03-07T22:16:32Z")

</div>

Hi.

Am 07-03-2016 21:15, schrieb [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> Here, nginx is proxy passing the requests to webseal and webseal sends  
> the  
> response with cookies.  
> We are trying to rewrite this cookie headers.

Please can you show us how you have tried to do this.

As you can see on this pages there should be a option with ‘plain’ nginx  
😉

[http://serverfault.com/questions/268633/controlling-nginx-proxy-target-using-a-cookie](http://serverfault.com/questions/268633/controlling-nginx-proxy-target-using-a-cookie)  
[https://maximilian-boehm.com/hp2134/NGINX-as-Proxy-Rewrite-Set-Cookie-to-Secure-and-HttpOnly.htm](https://maximilian-boehm.com/hp2134/NGINX-as-Proxy-Rewrite-Set-Cookie-to-Secure-and-HttpOnly.htm)

Please can you also post the output of nginx -V and the config.

Cheers Aleks

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 7, 2016, 9:32pm UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/8 "2016-03-07T21:32:08Z")

</div>

On 7 March 2016 at 22:15, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> Could you tell me more about LUA or some links where i can read about it?

Here you go:

> **[GitHub - openresty/lua-nginx-module: Embed the Power of Lua into NGINX HTTP servers](https://github.com/openresty/lua-nginx-module#header_filter_by_lua)**
>
> Embed the Power of Lua into NGINX HTTP servers

There you can replace the Set-Cookie-headers, and append HttpOnly and  
Secure flags.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 7, 2016, 10:51pm UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/9 "2016-03-07T22:51:00Z")

</div>

I have tried exactly the same as in this page:-

proxy\_cookie\_path / “/; secure; HttpOnly”;

it sets the flags on the cookie in the response header, but when I  
refresh the page, it is sending the cookies in the requests header  
without these flags, it just resets it.

Thanks,  
Krishna

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 7, 2016, 10:53pm UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/10 "2016-03-07T22:53:20Z")

</div>

Nginx -V

nginx version: nginx/1.8.0  
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-3) (GCC)  
built with OpenSSL 1.0.1e-fips 11 Feb 2013  
TLS SNI support enabled  
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx  
–conf-path=/etc/nginx/nginx.conf  
–error-log-path=/var/log/nginx/error.log  
–http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid  
–lock-path=/var/run/nginx.lock  
–http-client-body-temp-path=/var/cache/nginx/client\_temp  
–http-proxy-temp-path=/var/cache/nginx/proxy\_temp  
–http-fastcgi-temp-path=/var/cache/nginx/fastcgi\_temp  
–http-uwsgi-temp-path=/var/cache/nginx/uwsgi\_temp  
–http-scgi-temp-path=/var/cache/nginx/scgi\_temp --user=nginx  
–group=nginx --with-http\_ssl\_module --with-http\_realip\_module  
–with-http\_addition\_module --with-http\_sub\_module  
–with-http\_dav\_module --with-http\_flv\_module --with-http\_mp4\_module  
–with-http\_gunzip\_module --with-http\_gzip\_static\_module  
–with-http\_random\_index\_module --with-http\_secure\_link\_module  
–with-http\_stub\_status\_module --with-http\_auth\_request\_module  
–with-mail --with-mail\_ssl\_module --with-file-aio --with-ipv6  
–with-http\_spdy\_module --with-cc-opt=’-O2  
-g -pipe -Wp,-D\_FORTIFY\_SOURCE=2 -fexceptions -fstack-protector  
–param=ssp-buffer-size=4 -m64 -mtune=generic’

Config:-

#Security  
server\_tokens off; #Turn off version number  
add\_header X-Frame-Options “SAMEORIGIN”; #Turn off click jacking; so  
no frames  
add\_header X-XSS-Protection “1; mode=block”;  
add\_header X-Content-Type-Options nosniff;

# Redirect all insecure requests to the secure port

server {  
listen \<IP\_address\>:80 ;  
server\_name ;  
return 301 https://\<server\_name\>$request\_uri;  
}

# Serve SSL encrypted data

server {  
listen \<IP\_address\>:443 default\_server ssl;  
add\_header Strict-Transport-Security max-age=15768000;  
server\_name \<server\_name\>;

access\_log /web/nginx/servers/name/logs/access.log;  
error\_log /web/nginx/servers/name/logs/ error.log;

# Security

```
ssl on;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

```

ssl\_ciphers  
‘EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4’;

# Specify the certificate and key

```
ssl_certificate /etc/nginx/ssl/name/server.name.com.crt;
ssl_certificate_key /etc/nginx/ssl/name/server.name.com.key;

```

location /download/ {  
rewrite  
^/download/vadxeval$ “https:///mybrocade/secure/navigate?nid=n32&prodCode=VIRTUAL\_ADX&pname=VADX\_DOWNLOAD&completePath=downloads/Virtual  
ADX/Virtual ADX\_Eval” break;  
rewrite  
^/download/apitoolkit$ “https:// /mybrocade/secure/navigate?nid=n30&prodCode=BRD\_API\_SUPPORT&prodCatCode=API&pname=VYATTA\_DOWNLOAD&completePath=Brocade  
API Toolkit” break;  
}

location / {  
rewrite ^/$ https:// /wps/myportal/ break;  
rewrite ^/wps/portal$ http:// /wps/myportal/ break;

```
    index index.html;
    root /web/nginx/servers/name/conf;
proxy_set_header Host $server_name;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

proxy_pass http://<webseal_hostname>/;
proxy_read_timeout 90;

```

}  
}

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 8, 2016, 1:39am UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/11 "2016-03-08T01:39:50Z")

</div>

I am able to modify the set-cookie header from the server to flag it  
secure. I am trying to do the same in the request header as well.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 7, 2016, 11:57pm UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/12 "2016-03-07T23:57:36Z")

</div>

On Mon, Mar 07, 2016 at 09:50:00PM +0000, Krishna Kumar K K wrote:

Hi there,

> I have tried exactly the same as in this page:-
> 
> proxy\_cookie\_path / “/; secure; HttpOnly”;
> 
> it sets the flags on the cookie in the response header, but when I refresh the  
> page, it is sending the cookies in the requests header without these flags, it  
> just resets it.

That sounds like it is doing exactly what it should, no?

Flags are sent by the server in Set-Cookie response headers. Cookies  
are sent by the client (or not) in Cookie request headers.

What behaviour do you want that you are not seeing?

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 8, 2016, 8:45am UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/13 "2016-03-08T08:45:41Z")

</div>

Thing is its failing in the vulnerability scan (nexpose tool is used)  
saying cookie is not secure or httponly.

From: nginx [[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)] On Behalf Of Aapo  
Talvensaari  
Sent: Monday, March 07, 2016 11:34 PM  
To: removed\_email\_address@domain.invalid  
Subject: Re: secure and httponly cookies

On Tuesday, 8 March 2016, Krishna Kumar K K  
\<removed\_email\_address@domain.invalid[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)\> wrote:  
I am able to modify the set-cookie header from the server to flag it  
secure. I am trying to do the same in the request header as well.

Those flags are instructions to client. They don’t have meaning on  
request headers. Only on response headers.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 8, 2016, 8:34am UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/14 "2016-03-08T08:34:35Z")

</div>

On Tuesday, 8 March 2016, Krishna Kumar K K [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I am able to modify the set-cookie header from the server to flag it  
> secure. I am trying to do the same in the request header as well.

Those flags are instructions to client. They don’t have meaning on  
request  
headers. Only on response headers.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 8, 2016, 8:59am UTC](https://www.ruby-forum.com/t/secure-and-httponly-cookies/244218/15 "2016-03-08T08:59:43Z")

</div>

Hi.

Am 08-03-2016 08:44, schrieb Krishna Kumar K K:

> Thing is its failing in the vulnerability scan (nexpose tool is used)  
> saying cookie is not secure or httponly.

As Aapo said the request header is a client header.  
This is only changeable at client side with some javascript code.

If you want to use such a solution you can try this module.

> **[Module ngx\_http\_addition\_module](http://nginx.org/en/docs/http/ngx_http_addition_module.html)**

But to be more precise which request header do you want to change?

client request → nginx request → IBM WebSeal request → Other  
backend  
 ??? ???

> **[Module ngx\_http\_proxy\_module](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_set_header)**
>
> The ngx\_http\_proxy\_module module allows passing requests to another server.

You can also try to use the 'add\_header … ’ that the client receive  
the  
additional header and send it back at the following requests.

> **[Module ngx\_http\_headers\_module](http://nginx.org/en/docs/http/ngx_http_headers_module.html)**

As for the scanner he get’s the cookie from the response not from the  
request, afaik.  
Maybe you can turn on the debug logging and see what the scanner gets as  
response.

> **[A debugging log](http://nginx.org/en/docs/debugging_log.html)**

Maybe you will need the nginx-debug package.  
What’s your system on which you run nginx?

Aleks