unable to use secure cookies

[fibo]

I am trying to set secure cookies, it does not work at first try.

I am using

 secret: sessionSecret,
      resave: false,
      saveUninitialized: true,
      cookie: {
        secure: true,
        httpOnly: true,
        domain: 'beintoo.net',
        expires: expiryDate
      }

I found function issecure relying on req.connection.encrypted here but it seems not supported anymore, see expressjs/express#1864

Any hint?

[dougwilson]

Hi @fibo, is your Express server even listening on a SSL socket (https.createServer(app, options)) or are you terminating your SSL with a reverse proxy in front of your Node.js app?

[dougwilson]

Also, if you haven't already, please take a read through our documentation on this at https://github.com/expressjs/session#cookie-options and see if perhaps you just forgot to set some of those Express configurations or something.

[fibo]

Hi @dougwilson , I am using nginx to handle SSL. I had a look at the documentation but I could not found a solution. I found the line of code linked above cause I enabled debug with export DEBUG=express-session and saw the not secured message.

I have just tryed cookie-session Package and iwth the secureProxy option enabled worked almost out of the box.

Please let me know if I can contribute back with some additional info or test, otherwise close the issue.

[dougwilson]

Hi @fibo, what version of Express are you using? Have you tried adding the app.set('trust proxy', 1) to your code like in our example?

[fibo]

Yes, I tryed to set "trust proxy" as required in the documentation.

Unfortunately I am working on a private project right now so it is more difficult to show you. By the way, did you checked the line of code linked above? It refers to req.connection.encrypted which seems to be not valid anymore.

I am using Node v4.2.2, here are my deps:

  "dependencies": {
    "body-parser": "^1.14.1",
    "connect-ensure-login": "^0.1.1",
    "express-session": "^1.12.1",
    "debug": "^2.2.0",
    "express": "^4.13.3",
    "express-session": "^1.12.1",
    "jade": "^1.11.0",
    "mdconf": "0.0.2",
    "passport": "^0.3.2",
    "passport-local": "^1.0.0",
    "pg": "^4.4.3",
    "pg-promise": "^3.1.4",
    "pm2": "^1.0.0",
    "q": "^1.4.1",
    "sendgrid": "^2.0.0",
    "strict-mode": "^0.4.1"
  },

[dougwilson]

I did check that line, and the line is meaningless if you are using nginx, as the if check will always fail and move on. Is your nginx configured to add the X-Forwarded-Proto: https header to your node.js server?

[fibo]

I guess it is not, this is the config

upstream console {
    server 127.0.0.1:4000;
}

server {
    listen 443 ssl;
    ssl on;

    server_name console.beintoo.net;
    ssl_certificate /etc/nginx/ssl/www_example_net.chained.crt;
    ssl_certificate_key /etc/nginx/ssl/www_example_net.key;

    location / {
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
      proxy_set_header X-NginX-Proxy true;

      proxy_pass http://127.0.0.1:4000/;
      proxy_redirect off;
    }
 }

[dougwilson]

Ah, should be able to get proxy_set_header X-Forwarded-Proto https; added in there and it should be good to go?

[fibo]

Sorry, I did not had time to setup a server with nginx to reproduce this latter case you proposed me, since using cookie-session package worked out of the box.

Anyway, thanks for the hint, I will try it next time I will setup an express+nginx server with auth.

[fibo]

@dougwilson thank you very much for your support. It is thanks to people like you that internet was born. I hope you can have a lot of satisfaction from your future projects.

[dougwilson]

No problem. I think for issues like this, we can get some more information added to the README, like what the headers the secure stuff is looking for and maybe even links to configuring Apache/nginx. Since This uses the same headers that Express wants for the proxy configuration, if we get examples Apache/nginx configurations added to the exressjs.com website, we could link there from here. I think that would end up helping a lot :)