From 3fed04ee13ff27e440bf0db5c9fa1efed3b2a7a4 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 14:21:25 +0000 Subject: login: the session cookie Secure behind a TLS proxy Review finding 12, browsers: the session cookie had no Secure flag. Behind a TLS proxy, the token it carries went over plain HTTP if someone typed http://. POST /auth/session now sets Secure when the request came over TLS, as the proxy says (X-Forwarded-Proto, or Forwarded's proto, of the first hop). A client saying so itself only keeps its own cookie off plain HTTP. operations.md's nginx example sets the header. --- docs/operations.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'docs/operations.md') diff --git a/docs/operations.md b/docs/operations.md index f8dcdef..6aa06c2 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -117,11 +117,14 @@ continuum --bind-addr unix:/run/continuum/api.sock --htpasswd htpasswd ... ```nginx location / { proxy_pass http://unix:/run/continuum/api.sock; + proxy_set_header X-Forwarded-Proto $scheme; } ``` Without `--user-header`, no header names a user, so nothing a client sends through the -proxy can. +proxy can. With `X-Forwarded-Proto: https` (or `Forwarded: proto=https`), the +dashboard's session cookie is sent over TLS only (`Secure`), not over plain HTTP +should someone type `http://`. ### The proxy authenticating -- cgit v1.3.1