hey folks! I’m trying to set a secure flag to my c...

# ktor

[adeln]

hey folks! I’m trying to set a secure flag to my cookies, and I’m getting

java.lang.IllegalArgumentException: You should set secure cookie only via secure transport (HTTPS)

I’m running ktor on http, and proxying it through http/2 nginx. Is there a way to solve this?

[Jonathan Mew]

Do you use HTTPS to connect to nginx? The test that ktor uses is call.request.origin.scheme == "https"

[adeln]

but I don’t want TLS on 127.0.0.1 🙂 And I don’t know if that’s even possible

[adeln]

my application.conf:

ktor {
    application {
        modules = [ adeln.MainKt.module ]
    }
    deployment {
        host = "127.0.0.1"
        port = 8080
    }
}

[Jonathan Mew]

We have TLS set up - we use a *.localhost.com address on Chrome and set up a tls cert with https://github.com/FiloSottile/mkcert

[adeln]

are there any other benefits other than setting the secure cookie flag?

[Jonathan Mew]

I can't remember what gets treated differently by the browser - we set it up a long time ago now, sorry!
On the whole the more live-like our dev environments, the better 🙂

[Jonathan Mew]

I feel like we struggled with it for a bit but something did push us to finally iron it out

[adeln]

out of curiosity (I’m still new to this) do you launch both ktor & nginx on both dev & prod?

[Jonathan Mew]

On dev we serve from npm start. It's dockerised but we mount in our source to take advantage of hot reloading.

[Marc Knaup]

It's always good to use SSL locally. As Jonathan said - the closer your dev environment is to the live environment the better. You're more likely to spot issues that are related to SSL usage in this case. Even the additional remote DNS lookup can make a difference.

[adeln]

wow. I though they were completely unrelated — live has a separate domain, separate cert update schedule and all that

[Jonathan Mew]

separate domain is GOOD, keep that 🙂

[adeln]

and since I need nginx anyway to serve some files (PartialContent in ktor is far from perfect), I thought I’m ok with cleartext on 127.0.0.1.

Are there any resources to read on this?

[Jonathan Mew]

and I don't think cert update necessarily should be identical (I guess you might want some more trusted and more expensive cert for prod) though you might benefit from them being the same if you configure/renew through configuration as code, or if it's an option have a staging environment that is more live-like cert-wise

[Sergey Akhapkin]

@adeln Did you try to use XForwardedHeaderSupport feature for that? https://ktor.io/servers/features/forward-headers.html

[adeln]

I have not @Sergey Akhapkin , thanks for pointing it out!