Ktor: Do not enforce https on secure cookies

[schleinzer]

Hi,

I set my session cookie to "secure" and get "You should set secure cookie only via secure transport (HTTPS)" exception because my (CIO) server is not configured to use SSL.

But this is by design: I use a reverse proxy handling SSL and my ktor application is behind that (not using https intentionally).

Am I missing something or is the aforementioned check just too strict? If so, please remove it :-) (see link below)

Thank you!

https://github.com/ktorio/ktor/blob/848b63cc58f048efdda34a2c6060cce8a68584cb/ktor-server/ktor-server-core/jvm/src/io/ktor/response/ResponseCookies.kt#L29

[cy6erGn0m]

You should be using forwarded headers feature: https://ktor.io/servers/features/forward-headers.html so in this case the check will pass.

[schleinzer]

Ah, did not think of this! Quite obvious if you know about it ☺️ thank you very much, will try that.