If secure: true is not set on new Cookies(), cookie middleware will throw exception saying that secure flag is only available under secure connections when we try to set a secure cookie.
Add env var TRUST_PROXY_HEADERS to toggle it. This is because in some configuration there may be no proxies in front of koa. In that scenario we had better not trust proxy headers.
Env variables & x-forwarded-proto setup: see cofacts/rumors-deploy#13
Coverage remained the same at 88.158% when pulling 49d34e8e6c0d55ac9fe664c23fcc8c6187cc7d0b on samesite into 60d671509d2fa70e0a2bd733742818c34ba2dc44 on master.
This PR fixes #186 via:
SameSite
supportsamesite
andsecure
for session cookiessecure
is not set, session cookies (koa:sess
andkoa:sess.sig
) won't have Secure flag, and the browser does not apply SameSite=NoneCOOKIE_SAMESITE_NONE
to toggle it. In some casesamesite
may be not required.x-forwarded-proto
and sendsecure: true
when callingnew Cookies()
.secure: true
is not set onnew Cookies()
, cookie middleware will throw exception saying thatsecure
flag is only available under secure connections when we try to set a secure cookie.TRUST_PROXY_HEADERS
to toggle it. This is because in some configuration there may be no proxies in front of koa. In that scenario we had better not trust proxy headers.x-forwarded-proto
setup: see cofacts/rumors-deploy#13