secure cookies not working, despite successful https connection
hi :) i am trying to debug my express server. i have a reverse proxy set up with nginx and let’s encrypt. i am able to successfully connect using https. i get the green lock and it says ‘connection secure’. i am using session-based auth with express-sessions. my cookies work perfectly when the secure flag is not set. the moment i set secure to true my cookies gets rejected. not sure why this is, i have trust-proxy set up and my connection is secure. any ideas? here is a sample of the logs i am getting: “some cookies are misusing the recommended “samesite“ attribute” “cookie “sid” has been rejected because it is already expired.” and here is my cookie setup: if (process.env.node\_env  "production") { app.set('trust proxy', 1) } app.use( session({ name: "sid", resave: false, saveuninitialized: false, secret: process.env.session\_secret, cookie: { domain: process.env.base\_url, path: "/", samesite: "strict", secure: process.env.node\_env  "production" ? true : false, maxage: 1000 * 60 * 60 * 2, // 2 hours }, store: mongostore.create({ client: db.getclient(), ttl: 60 * 60 * 2, // 2 hours, in seconds touchafter: 24 * 3600, // time period in seconds crypto: { secret: process.env.store\_secret, }, }), }) ); like i mentioned, no logs or errors once i take out secure (i.e. if i don’t see my node\_env to “production”) thank you in advance.
hi there, could you also share the nginx server block that you are using here? i could suggest adding the following to your reverse proxy configuration: proxy\_set\_header x-forwarded-proto $scheme; regards, bobby
i was using showsignintogettokens() and switched to showsigninandredirect(). looks like the former only supports popups for social logins. the latter results in more redirects, but at least the experience is better for users (popup blockers don’t hamper the experience). ah! someone gave me the answer!

[chrome recently applied](https://www.kevel.co/blog/chrome-samesite/) a new default of " lax " to the " samesite " parameter of cookies. lax was not lax enough; i needed to set samesite=none .

added to [localsettings.php of mediawiki](https://www.mediawiki.org/wiki/manual:%24wgcookiesamesite):

$wgcookiesamesite='none';

thanks!!

​ this is because the /login page, once a login occurs, the ‘state’ parameter is missing and so when the page tries to call the /authorize url it will error. the state parameter is used to mitigate csrf attack and so during authentication, the application sends this parameter in the authorization … ingest manager requires that security is enabled. you cannot use ingest manager unless you turn security on.

<https://www.elastic.co/guide/en/ingest-management/7.9/ingest-management-getting-started.html>
<https://www.elastic.co/guide/en/ingest-management/7.9/ingest-management-troubleshooting.html> first of all, you need to check if you are using a self-signed certificate.

if so, you have to accept it first: double-clicked on the request in the network pane, and ow prompted you whether you wanted to accept the certificate.

other option will be to use the [overwolf.web.sendhttprequest()](http://developers.overwolf.com/documentation/sdk/overwolf/web/#sendhttprequest) funct… hi, 
  
we did try following: 
  
1. update java to the latest version 
this didn't affect the cpu or ram consumption. 
  
2. assign more ram for java, we found on other forums that high pcu consumption was caused by lack of memory. 
this didn't affect the cpu consumption neither 
  
3. change the port for connector from 8443 to to save resources for port redirection. 
the cpu consumption for the redirection is so low that it didn't change either 
  
4. try to disable autodeploy and do it manually 
we couldn't do this as the concerned era is allready in production 
  
5. do you have issues with http traffic as well or just with https? 
as we are working on security, there is just no http at all ! (disabled in tomcat) 
  
  
but we found out that regarding the place from which we did connect (and the available bandwith) it did impact the behavior. 
whith a good bandwith: the page loads in something as 10 to 15 seconds and cpu load doesn't go at 100% or just for the few last seconds 
whith a bad bandwith: the page takes 1 to 3 minutes to load and cpu consumption goes to 100% (over several cores) after the 10 first seconds (just like a memory leak but with cpu). 
  
we don't get why but the longer it takes for the client's side (browser) to load the app, how more cpu is consumes on server... after further research and coming across [this answer to a similar issue](https://community.auth0.com/t/failed-silent-auth-login-required/33165/39), i made the switch to auth0’s custom domain solution and it fixed all of the issues mentioned above. this topic can be closed! i just solved the problem myself. there was something wrong with my browser. after a restart everything is working as expected. sorry for the hassle. [tutorial] how to view cookies - how to view cookies is an article on the wikihow website that explains all the steps you should follow if you want to view your browser's cookies. it explains how to do this on google chrome, firefox, microsoft edge, internet explorer, and safari. was caused because there was an "unhandled rejection error: eacces: permission denied, mkdir '/home//.npm/\_cache/index-<…>/

solved problem by just adding “sudo” in front

sudo npx create-react-app .