☰

在 nginx 反向代理上设置 SameSite=None

tag-icon • tag-icon nginx proxy cookies
在 nginx 反向代理上设置 SameSite=None

当我在配置文件中设置 cookie 规则时，使用 nginx pod（在 docker 上）作为反向代理时遇到问题。这是我的 nginx.conf 文件：



events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    access_log  /var/log/nginx/access.log;
    server_names_hash_bucket_size 64;
    sendfile        on;
    tcp_nopush     on;
    #keepalive_timeout  0;
    keepalive_timeout  65;
    tcp_nodelay        on;
    gzip  on;
    gzip_comp_level   5;
    gzip_http_version 1.0;
    gzip_min_length   0;
    gzip_types        text/plain text/html text/css image/x-icon  application/x-javascript;
    gzip_vary         on;
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
server {
        listen   8080;
        server_name  XXXXXX.com;
        access_log  /var/log/webapp.access.log;
        error_log  /var/log/webapp.nginx_error.log debug;
        large_client_header_buffers 4 32k;
        location /wait {
                proxy_pass http://YYYYYYY.com;
                proxy_cookie_path / "/; secure; HttpOnly; SameSite=None";
        }
        
       
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
                root   /var/www/nginx-default;
        }
}
}

当我拨打 XXXXXX.com/wait 时，我得到了以下响应

HTTP/1.1 200 Connection established
date: Mon, 17 May 2021 05:40:26 GMT
content-type: text/html;charset=UTF-8
vary: Accept-Encoding
vary: Origin
vary: Access-Control-Request-Method
vary: Access-Control-Request-Headers
last-modified: Wed, 12 May 2021 13:08:26 GMT
content-language: fr
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2

如您所见，我没有看到有关我的 cookie 规则的任何信息：

proxy_cookie_path / "/; secure; HttpOnly; SameSite=None";

您有什么想法吗？谢谢

答案1

该规则应该重写收到的 Cookie，例如

Set-Cookie：有效期=2021 年 5 月 19 日星期四 00:00:00 GMT；最大年龄=111111；路径=/

设置 Cookie：expires=Thu, 19-May-2021 00:00:00 GMT；Max-Age=111111；Path=/；安全；HttpOnly；SameSite=None”；

但响应似乎不包含“set-cookie”，因此不会修改任何内容。

相关内容