Some cookies are misusing the recommended “SameSite“ attribute Error in Nginx Reverse Proxy

201 Views Asked by At

I have a Nuxt.js application serving on 127.0.0.1:3000 address, Laravel application listens on 443 port for backend purposes. Also have a nginx 1.24.0 listening on 443 with reverse proxy that proxies all requests to nuxt.js application and php-fpm configuration for backend app. Also server added to Cloudflare proxy.

Now I have cookie error when user login in web application. Resources not loaded from api, even from frontend.

My nginx configuration is like that(Didin't add the full config, if it necessary i will add):

For nuxt.js:

location / {
        add_header Access-Control-Allow-Origin '*';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
        add_header 'Set-Cookie' 'SameSite=None; Secure';
        add_header 'Access-Control-Allow-Credentials' 'true';
        proxy_cookie_path / "/; secure; HttpOnly; SameSite=None";
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        }

For laravel app

location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.1-fpm.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }



location / {
        add_header Access-Control-Allow-Origin *;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
        add_header 'Set-Cookie' 'SameSite=None; Secure';
        add_header 'Access-Control-Allow-Credentials' 'true';
        try_files $uri $uri/ /index.php?$query_string;
        
    }

You can see in the config, I have already set the "Set-Cookie" header with "SameSite=none; Secure" value. I can see the headers when i send dummy request with curl (curl -IL https://website.com).

I had done all solutions that i can find in the internet. I cannot do in Application side, because when i serve the app via Apache it is solved. But i want to serve via Nginx. You know apache kinda like slow.

I can provide any information if will necessary for solution.

0

There are 0 best solutions below