How to instruct Phoenix to set secure flag (HTTPS only) on session cookie?

acrolink · May 20, 2018, 8:32pm

I have noticed that the session cookie is not set to secure, how to turn the secure flag on for Phoenix sessions?

Gazler · May 21, 2018, 8:20am

You should have something like this in your endpoint:

  plug Plug.Session,
    store: :cookie,
    key: "_hello_key",
    signing_salt: "change_me"

This uses Plug.Session. One of the options is secure which can be passed as an option to the plug.

  plug Plug.Session,
    store: :cookie,
+   secure: true,
    key: "_hello_key",
    signing_salt: "change_me"

OvermindDL1 · May 21, 2018, 7:24pm

This isn’t default? It really should be default! It’s not like it’s useful to javascript anyway considering it is encoded… ^.^;

Gazler · May 22, 2018, 7:44am

They are different things.

secure means that the cookie should only be sent over HTTPS (this defaults to true in plug if using HTTPS, but won’t be true if you use HTTP behind a load balancer.)

I think the configuration you are referring to is http-only which determines if the cookie is available to JavaScript or not, which does default to true for cookie storage.

github.com

elixir-plug/plug/blob/e60914b10ab3a880c15de844d3b231893060aaea/lib/plug/conn/cookies.ex#L64


"""
def encode(key, opts \\ %{}) when is_map(opts) do
  value = Map.get(opts, :value)
  path = Map.get(opts, :path, "/")


  IO.iodata_to_binary([
    "#{key}=#{value}; path=#{path}",
    emit_if(opts[:domain], &["; domain=", &1]),
    emit_if(opts[:max_age], &encode_max_age(&1, opts)),
    emit_if(Map.get(opts, :secure, false), "; secure"),
    emit_if(Map.get(opts, :http_only, true), "; HttpOnly"),
    emit_if(opts[:extra], &["; ", &1])
  ])
end


defp encode_max_age(max_age, opts) do
  time = Map.get(opts, :universal_time) || :calendar.universal_time()
  time = add_seconds(time, max_age)
  ["; expires=", rfc2822(time), "; max-age=", Integer.to_string(max_age)]
end

OvermindDL1 · May 22, 2018, 6:05pm

Ah, could use a more descriptive name (:send_of_https_only or so) I’d say.

Gazler · May 22, 2018, 6:21pm

The names come from the spec.

Secure: https://tools.ietf.org/html/rfc6265#section-5.2.5

HttpOnly: https://tools.ietf.org/html/rfc6265#section-5.2.6

OvermindDL1 · May 22, 2018, 7:58pm

Ah cool! That should be linked in the docs with more of an explanation!

zenw0lf · September 20, 2019, 10:34pm

That’s more like general knowledge related to web development in general, than related to any framework really.

Is something you should/can know without touching Phoenix at all.