Allow the developer to send secure cookies no matter what about cookies HOT 13 CLOSED

Has anyone solved this issue for koa?

from cookies.

@fengmk2 it seem this still happen in koa

from cookies.

This issue, "Allow the developer to send secure cookies no matter what" is already fixed in the version 0.6.0 release. Just set secure: true in your Cookies constructor and then this module will assume the request is secure for setting secure cookie and will not examine the request itself.

from cookies.

sounds good to me, though i think devs need some warning. @dougwilson

from cookies.

Yea. I am 👍 on changing the module to allow people to shoot themselves in the foot by sending a secure cookie over a potentially non-secure connection, because it just adds a lot of complexity to the module otherwise. I believe there is a way to do this is a backwards-compatible way and provide any necessary warnings :)

TL;DR I'm in favor, so it'll get added in soon.

from cookies.

Thanks all.
2014-7-30 上午3:45于 "Douglas Christopher Wilson" [email protected]写道：

Yea. I am [image: 👍] on changing the module to allow people to shoot
themselves in the foot by sending a secure cookie over a potentially
non-secure connection, because it just adds a lot of complexity to the
module otherwise. I believe there is a way to do this is a
backwards-compatible way and provide any necessary warnings :)

TL;DR I'm in favor, so it'll get added in soon.

—
Reply to this email directly or view it on GitHub
#51 (comment).

from cookies.

What's the status of this? How is everyone else working around this? It's pretty common to use SaaS providers, like heroku to have an unencrypted connection between their load balancer and your app. As well doing SSL termination in nginx and what not.

from cookies.

They are using Express or something else that updates req.protocol based on the reverse proxy.

from cookies.

As a side-note, this issue wasn't assigned to me, so I didn't even remember it existed. That's fixed now.

from cookies.

me too …

from cookies.

FYI this isn't working through .set(..., opts), on the latest version.

from cookies.

FYI this isn't working through .set(..., opts), on the latest version.

Me too. setting secure: true inctx.cookies.set(..., opts) doesn't work, still throw Cannot send secure cookie over unencrypted connection

from cookies.

You need to construct it with the override first: cookies = new Cookies( request, response, { secure: true })

from cookies.