Good day, I'm struggling to set `cookie.secure = t...

# ktor

[tim]

Good day, I'm struggling to set cookie.secure = true as my server is throwing. I've been trying to work through this to no success. Here's the top of the stacktrace:

10:15:06.019 [ktor-jetty-10001-1] ERROR Application - 500 Internal Server Error: GET - /cloud/v1/vault
java.lang.IllegalArgumentException: You should set secure cookie only via secure transport (HTTPS)
	at io.ktor.response.ResponseCookies.append(ResponseCookies.kt:30)
	at io.ktor.sessions.SessionTransportCookie.send(SessionTransportCookie.kt:52)
	at io.ktor.sessions.SessionsKt.sendSessionData(Sessions.kt:214)
	at io.ktor.sessions.Sessions$Feature$install$2.invokeSuspend(Sessions.kt:76)
	at io.ktor.sessions.Sessions$Feature$install$2.invoke(Sessions.kt)
	at io.ktor.util.pipeline.SuspendFunctionGun.loop(PipelineContext.kt:318)
	at io.ktor.util.pipeline.SuspendFunctionGun.proceed(PipelineContext.kt:163)
	at io.ktor.util.pipeline.SuspendFunctionGun.execute(PipelineContext.kt:183)
	at io.ktor.util.pipeline.Pipeline.execute(Pipeline.kt:27)

I'm running my ktor behind an nginx proxy which terminates https and passes the request on via reverse proxy to the ktor server. Nginx is forwarding these X-Forwarded headers:

"X-Forwarded-For": "[omitted]",
  "X-Forwarded-Proto": "[https]",

And nginx conf block:

location /cloud/v1 {
  proxy_set_header X-Forwarded-For $remote_addr;
  proxy_set_header X-Forwarded_Proto 'https';
  proxy_pass <http://127.0.0.1:10001>;
}

In my ktor server setup i have:

install(XForwardedHeaderSupport)

As far as I have read, this should now be working but I am still getting the error. I have logged out call.request.origin.scheme inside one of my controllers and its returning http so it appears that the XForwadedHeaderSupport isn't setting the scheme to https ... any suggestions?! 🙏

[spand]

Ktor should not fail on this imo. Your usecase is perfectly normal

[tim]

I must be doing something wrong here?

[spand]

Not in my mind. I would submit a bug report to have this check removed from ktor.

[tim]

Okay I'm a numpty ... totally my own fault. I mispelt the header in my nginx.conf 😳

I had X-Forwarded_Proto not X-Forwarded-Proto

Seems to be working as expected now 🙂