acrolink
How to instruct Phoenix to set secure flag (HTTPS only) on session cookie?
I have noticed that the session cookie is not set to secure, how to turn the secure flag on for Phoenix sessions?
Marked As Solved
Gazler
You should have something like this in your endpoint:
plug Plug.Session,
store: :cookie,
key: "_hello_key",
signing_salt: "change_me"
This uses Plug.Session. One of the options is secure which can be passed as an option to the plug.
plug Plug.Session,
store: :cookie,
+ secure: true,
key: "_hello_key",
signing_salt: "change_me"
Also Liked
Gazler
Gazler
They are different things.
secure means that the cookie should only be sent over HTTPS (this defaults to true in plug if using HTTPS, but won’t be true if you use HTTP behind a load balancer.)
I think the configuration you are referring to is http-only which determines if the cookie is available to JavaScript or not, which does default to true for cookie storage.
OvermindDL1
Last Post!
apoorv-2204
What to when we want to put some session cookie based on env?
I am currently using this
@dev_env? Application.compile_env(:core, [:app_env], :prod) in ["dev", :dev]
@session_options (case(!!@dev_env?) do
true ->
[
max_age: 120 * 60 * 60,
store: OPSWeb.Session.Store,
key: "_OPSWeb_",
signing_salt: "OPSWeb="
]
false ->
[
max_age: 120 * 60 * 60,
store: OPSWeb.Session.Store,
key: "_OPSWeb_",
signing_salt: "OPSWeb=",
secure: true,
http_only: true
]
end)
but when I want to get session options via function or compile env it fails
see issue
Popular in Questions
Other popular topics
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #elixirconf-us
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #security
- #hex









