secure and httponly cookies

Aleksandar Lazic al-nginx at
Tue Mar 8 07:59:09 UTC 2016


Am 08-03-2016 08:44, schrieb Krishna Kumar K K:
> Thing is its failing in the vulnerability scan (nexpose tool is used)
> saying cookie is not secure or httponly.

As Aapo said the request header is a client header.
This is only changeable at client side with some javascript code.

If you want to use such a solution you can try this module.

But to be more precise which request header do you want to change?

client request --> nginx request --> IBM WebSeal request --> Other 
   <JavaScript>    <Proxy set header>   ???                    ???

You can also try to use the 'add_header ... ' that the client receive 
additional header and send it back at the following requests.

As for the scanner he get's the cookie from the response not from the 
request, afaik.
Maybe you can turn on the debug logging and see what the scanner gets as 

Maybe you will need the nginx-debug package.
What's your system on which you run nginx?


> FROM: nginx [mailto:nginx-bounces at] ON BEHALF OF Aapo
> Talvensaari
> SENT: Monday, March 07, 2016 11:34 PM
> TO: nginx at
> SUBJECT: Re: secure and httponly cookies
> On Tuesday, 8 March 2016, Krishna Kumar K K <krishna at> 
> wrote:
>> I am able to modify the set-cookie header from the server to flag it
>> secure. I am trying to do the same in the request header as well.
> Those flags are instructions to client. They don't have meaning on
> request headers. Only on response headers.
> _______________________________________________
> nginx mailing list
> nginx at

More information about the nginx mailing list