Setting SameSite=None on nginx reverse proxy

Question

i got a problem using my nginx pod (on docker) as a reverse proxy when i set cookie rules in my configuration file. Here is my nginx.conf file :



events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    access_log  /var/log/nginx/access.log;
    server_names_hash_bucket_size 64;
    sendfile        on;
    tcp_nopush     on;
    #keepalive_timeout  0;
    keepalive_timeout  65;
    tcp_nodelay        on;
    gzip  on;
    gzip_comp_level   5;
    gzip_http_version 1.0;
    gzip_min_length   0;
    gzip_types        text/plain text/html text/css image/x-icon  application/x-javascript;
    gzip_vary         on;
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
server {
        listen   8080;
        server_name  XXXXXX.com;
        access_log  /var/log/webapp.access.log;
        error_log  /var/log/webapp.nginx_error.log debug;
        large_client_header_buffers 4 32k;
        location /wait {
                proxy_pass http://YYYYYYY.com;
                proxy_cookie_path / "/; secure; HttpOnly; SameSite=None";
        }
        
       
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
                root   /var/www/nginx-default;
        }
}
}

and i got the following response when I call XXXXXX.com/wait

HTTP/1.1 200 Connection established
date: Mon, 17 May 2021 05:40:26 GMT
content-type: text/html;charset=UTF-8
vary: Accept-Encoding
vary: Origin
vary: Access-Control-Request-Method
vary: Access-Control-Request-Headers
last-modified: Wed, 12 May 2021 13:08:26 GMT
content-language: fr
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2

As you can see, i don't see anything about my cookie rule :

proxy_cookie_path / "/; secure; HttpOnly; SameSite=None";

Do you have an idea? Thanks

score 0 · Answer 1 · answered May 19 '21 at 19:36

The Rule should rewrite a Cookie received e.g.

Set-Cookie: expires=Thu, 19-May-2021 00:00:00 GMT; Max-Age=111111; Path=/

to Set-Cookie: expires=Thu, 19-May-2021 00:00:00 GMT; Max-Age=111111; Path=/; secure; HttpOnly; SameSite=None";

but the response doesn't seem to include a "set-cookie" so nothing would be modified.

Setting SameSite=None on nginx reverse proxy

1 Answers1