acrolink

acrolink

How to instruct Phoenix to set secure flag (HTTPS only) on session cookie?

I have noticed that the session cookie is not set to secure, how to turn the secure flag on for Phoenix sessions?

Marked As Solved

Gazler

Gazler

Phoenix Core Team

You should have something like this in your endpoint:

  plug Plug.Session,
    store: :cookie,
    key: "_hello_key",
    signing_salt: "change_me"

This uses Plug.Session. One of the options is secure which can be passed as an option to the plug.

  plug Plug.Session,
    store: :cookie,
+   secure: true,
    key: "_hello_key",
    signing_salt: "change_me"
13
Post #1

Also Liked

Gazler

Gazler

Phoenix Core Team
Gazler

Gazler

Phoenix Core Team

They are different things.

secure means that the cookie should only be sent over HTTPS (this defaults to true in plug if using HTTPS, but won’t be true if you use HTTP behind a load balancer.)

I think the configuration you are referring to is http-only which determines if the cookie is available to JavaScript or not, which does default to true for cookie storage.

https://github.com/elixir-plug/plug/blob/e60914b10ab3a880c15de844d3b231893060aaea/lib/plug/conn/cookies.ex#L64

OvermindDL1

OvermindDL1

Ah cool! That should be linked in the docs with more of an explanation! :slight_smile:

Last Post!

apoorv-2204

apoorv-2204

What to when we want to put some session cookie based on env?
I am currently using this

@dev_env? Application.compile_env(:core, [:app_env], :prod) in ["dev", :dev]

  @session_options (case(!!@dev_env?) do
                      true ->
                        [
                          max_age: 120 * 60 * 60,
                          store: OPSWeb.Session.Store,
                          key: "_OPSWeb_",
                          signing_salt: "OPSWeb="
                        ]

                      false ->
                        [
                          max_age: 120 * 60 * 60,
                          store: OPSWeb.Session.Store,
                          key: "_OPSWeb_",
                          signing_salt: "OPSWeb=",
                          secure: true,
                          http_only: true
                        ]
                    end)

but when I want to get session options via function or compile env it fails
see issue

Where Next?

Popular in Questions Top

Emily
I have VueJS GUIs with the project generated using Webpack. I have Elixir modules that will need to be used by the VueJS GUIs. I forese...
New
lessless
I believe there are people here who are dealing with CSV files import on the daily basis, and since Excel is a really popular tool there ...
New
ashish173
I am using Ecto timestamps with postgres, I can see the timestamps() use the :naive_dateime but for my use case I wanted to store the ti...
New
stefanchrobot
What’s the safe way to decode a JSON string into a struct? I want to avoid calling String.to_atom. Jason.decode can give me a map with st...
New
siddhant3030
Hi, I have to write a raw query for one of my project. But till now I have used ecto queries and don’t have much experience writing raw ...
New
romenigld
I am trying to run a deploy with docker and I successfully runned with this command: docker build -t romenigld/blog-prod . but when I t...
New
fayddelight
I tried installing elixir 1.11.2 erlang 23.3.4 via asdf in my zsh shell. Enabled the versions locally and globally. When I list them ...
New

Other popular topics Top

nobody
Hi! In PHP: $_SERVER[‘SERVER_ADDR’] - in Elixir? Searched the docs for ip address and the web, no good results. Thanks!
New
vertexbuffer
Hello, can anybody help here..? I have a list of players and I what to delete an element, but every for loop the list is reverting to ori...
New
nsuchy
Hi. I’ve noticed that Windows Powershell has it’s own IEX command and you cannot access Elixir’s IEX due to the conflict. This isn’t a cr...
New
dogweather
I wrote this comment on r/haskell, and it’s not popular there. :wink: But I think I’m on to something… Haskell reminds me of Java, and e...
New
AstonJ
Seen any cool LiveView demos, sample apps or examples? Please post them here! :003:
New
bsollish-terakeet
Credo is smart enough to check for (something like) this: assert length(the_list) == 0 with this response: Checking if an enum is empt...
New

We're in Beta

About us Mission Statement