login: the session cookie Secure behind a TLS proxy

Review finding 12, browsers: the session cookie had no Secure flag.
Behind a TLS proxy, the token it carries went over plain HTTP if
someone typed http://.

POST /auth/session now sets Secure when the request came over TLS, as
the proxy says (X-Forwarded-Proto, or Forwarded's proto, of the first
hop). A client saying so itself only keeps its own cookie off plain
HTTP. operations.md's nginx example sets the header.

1 files changed, 4 insertions, 1 deletions

diff --git a/docs/operations.md b/docs/operations.md
index f8dcdef..6aa06c2 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -117,11 +117,14 @@ continuum --bind-addr unix:/run/continuum/api.sock --htpasswd htpasswd ...
 ```nginx
 location / {
     proxy_pass http://unix:/run/continuum/api.sock;
+    proxy_set_header X-Forwarded-Proto $scheme;
 }
 ```
 
 Without `--user-header`, no header names a user, so nothing a client sends through the
-proxy can.
+proxy can. With `X-Forwarded-Proto: https` (or `Forwarded: proto=https`), the
+dashboard's session cookie is sent over TLS only (`Secure`), not over plain HTTP
+should someone type `http://`.
 
 ### The proxy authenticating