You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@savsgio , when fasthttp server is behind a proxy and there is no TLS link between the proxy and the server because let say the server and the proxy are on the same host, the secure flag of the cookie should legitimately be set to true to enhance security.
I propose to add a configuration attribute called TrustedProxies being a list of strings being known and trusted IPs of proxies in order to mimic the behavior of the Express framework as described in this documentation: http://expressjs.com/en/guide/behind-proxies.html.
So what I propose is to check whether the connection is over TLS || (the remote IP is a trusted proxy && X-Forwarde-Proto is set to https) by modifying the following line:
@savsgio , when fasthttp server is behind a proxy and there is no TLS link between the proxy and the server because let say the server and the proxy are on the same host, the secure flag of the cookie should legitimately be set to
true
to enhance security.I propose to add a configuration attribute called
TrustedProxies
being a list of strings being known and trusted IPs of proxies in order to mimic the behavior of the Express framework as described in this documentation: http://expressjs.com/en/guide/behind-proxies.html.So what I propose is to check whether
the connection is over TLS
|| (the remote IP is a trusted proxy
&&X-Forwarde-Proto is set to https
) by modifying the following line:session/cookie.go
Line 37 in 1f4f9f4
Would that sound reasonable to you?
The text was updated successfully, but these errors were encountered: