hey folks I m trying to set a secure flag to my cookies and

Question

hey folks I m trying to set a secure flag to my cookies and I m getting ``` java lang IllegalArgumentException You should set secure cookie only via secure transport HTTPS ``` I m running ktor on http and proxying it through http 2 nginx Is there a way to solve this

Jonathan Mew · Answer

Do you use HTTPS to connect to nginx The test that ktor uses is `call request origin scheme == https `

adeln · Answer

but I don t want TLS on 127 0 0 1 slightly smiling face And I don t know if that s even possible

adeln · Answer

my application conf ``` ktor application modules = adeln MainKt module deployment host = 127 0 0 1 port = 8080 ```

Jonathan Mew · Answer

We have TLS set up we use a address on Chrome and set up a tls cert with

adeln · Answer

are there any other benefits other than setting the secure cookie flag

Jonathan Mew · Answer

I can t remember what gets treated differently by the browser we set it up a long time ago now sorry On the whole the more live like our dev environments the better slightly smiling face

Jonathan Mew · Answer

I feel like we struggled with it for a bit but something did push us to finally iron it out

adeln · Answer

out of curiosity I m still new to this do you launch both ktor amp nginx on both dev amp prod

Jonathan Mew · Answer

On dev we serve from npm start It s dockerised but we mount in our source to take advantage of hot reloading

Marc Knaup · Answer

It s always good to use SSL locally As Jonathan said the closer your dev environment is to the live environment the better You re more likely to spot issues that are related to SSL usage in this case Even the additional remote DNS lookup can make a difference

adeln · Answer

wow I though they were completely unrelated live has a separate domain separate cert update schedule and all that

Jonathan Mew · Answer

separate domain is GOOD keep that slightly smiling face

adeln · Answer

and since I need nginx anyway to serve some files PartialContent in ktor is far from perfect I thought I m ok with cleartext on 127 0 0 1 Are there any resources to read on this

Jonathan Mew · Answer

and I don t think cert update necessarily should be identical I guess you might want some more trusted and more expensive cert for prod though you might benefit from them being the same if you configure renew through configuration as code or if it s an option have a staging environment that is more live like cert wise

Sergey Akhapkin · Answer

< adeln> Did you try to use XForwardedHeaderSupport feature for that

adeln · Answer

I have not < Sergey Akhapkin> thanks for pointing it out