acrolink

acrolink

How to instruct Phoenix to set secure flag (HTTPS only) on session cookie?

I have noticed that the session cookie is not set to secure, how to turn the secure flag on for Phoenix sessions?

Marked As Solved

Gazler

Gazler

Phoenix Core Team

You should have something like this in your endpoint:

  plug Plug.Session,
    store: :cookie,
    key: "_hello_key",
    signing_salt: "change_me"

This uses Plug.Session. One of the options is secure which can be passed as an option to the plug.

  plug Plug.Session,
    store: :cookie,
+   secure: true,
    key: "_hello_key",
    signing_salt: "change_me"
13
Post #1

Also Liked

Gazler

Gazler

Phoenix Core Team
Gazler

Gazler

Phoenix Core Team

They are different things.

secure means that the cookie should only be sent over HTTPS (this defaults to true in plug if using HTTPS, but won’t be true if you use HTTP behind a load balancer.)

I think the configuration you are referring to is http-only which determines if the cookie is available to JavaScript or not, which does default to true for cookie storage.

https://github.com/elixir-plug/plug/blob/e60914b10ab3a880c15de844d3b231893060aaea/lib/plug/conn/cookies.ex#L64

OvermindDL1

OvermindDL1

Ah cool! That should be linked in the docs with more of an explanation! :slight_smile:

Last Post!

apoorv-2204

apoorv-2204

What to when we want to put some session cookie based on env?
I am currently using this

@dev_env? Application.compile_env(:core, [:app_env], :prod) in ["dev", :dev]

  @session_options (case(!!@dev_env?) do
                      true ->
                        [
                          max_age: 120 * 60 * 60,
                          store: OPSWeb.Session.Store,
                          key: "_OPSWeb_",
                          signing_salt: "OPSWeb="
                        ]

                      false ->
                        [
                          max_age: 120 * 60 * 60,
                          store: OPSWeb.Session.Store,
                          key: "_OPSWeb_",
                          signing_salt: "OPSWeb=",
                          secure: true,
                          http_only: true
                        ]
                    end)

but when I want to get session options via function or compile env it fails
see issue

Where Next?

Popular in Questions Top

joaquinalcerro
Hi there, I am working with Ecto-Postgresql and I need to call all of the records from a specific table but the table has 40,000 records...
New
openscript
Hello! Sorry for this astonishing simple question, but I’m really stuck. I try to set up the intellij-elixir plugin, but I don’t know ho...
New
ashish173
I am using Ecto timestamps with postgres, I can see the timestamps() use the :naive_dateime but for my use case I wanted to store the ti...
New
Fl4m3Ph03n1x
About me? ( if you have nothing better to do than reading about some random guy in the internet :stuck_out_tongue: ) Hello all, this is ...
New
9mm
I am constructing a JSON object (map) and I need to conditionally set a field. I’m trying to write proper elixir-way code… and I’m at a l...
New
sergio_101
I am VERY much an elixir newbie. I have taken one elixir course and one phoenix course on Udemy. During that course, I saw the instructor...
New
vrod
I am using the Starship cross-shell prompt – it seems pretty nice, but I get some errors: [WARN] - (starship::utils): Executing command ...
New

Other popular topics Top

JeremM34
Hello, how can I check the Phoenix version ? Thanks !
New
hariharasudhan94
Lets say I have map like this fetching from my database %{"_id" => #BSON.ObjectId<58eb1a7a9ad169198c3dXXXX>, "email" => ...
New
aadeshere1
I have a another noob question about loop. Since elixir is immutable, while loop is not directly possible. total = 10 while total != 0 ...
New
dogweather
I wrote this comment on r/haskell, and it’s not popular there. :wink: But I think I’m on to something… Haskell reminds me of Java, and e...
New
sorentwo
Hello! tl;dr Announcing Oban, an Ecto based job processing library with a focus on reliability and historical observability. After spen...
985 44778 311
New
senggen
Erlang/OTP 25 [erts-13.2.2] [source] [64-bit] [smp:8:8] [ds:8:8:10] [async-threads:1] 15:22:35.803 [error] gen_event {lager_file_backend...
New

We're in Beta

About us Mission Statement