bit07123
bit07123

Reputation: 15

Sending Secure Session Cookie With AWS Elastic Beanstalk SSL

I've deployed an app to AWS Elastic Beanstalk and have SSL set up using the AWS Certificate Manager. However, when I use an Express-session cookie that has { secure: true } it doesn't get sent to the client when they login with OAuth.

I'm using docker-compose to connect 3 services: a client, api, and nginx reverse proxy. I'm serving my client build through an nginx server as well:

server {
  listen 3000;  
  
  location / {
    root /usr/share/nginx/html;
    index index.html index.htm;
    try_files $uri $uri/ /index.html;
  }      
}

Nginx Reverse Proxy:

http {

    upstream client {
        server client:3000;
    }

    upstream api {
        server api:8080;
    }

    server {
        listen 80;

        location /api {
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            
            rewrite /api/(.*) /$1 break;
            proxy_pass http://api;

        }

        location / {
            proxy_pass http://client;

            # Enable WebSocket support, needed for HMR in React
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
        }
    }
}

events {}

I'm wondering if this is the expected behavior because a solution I'm trying is to setup another SSL certificate between containers so that their communication is in https. I've tried setting trust proxy to true and other variations but it doesn't resolve the issue. If it's helpful I use passport.js with the google-oauth20 strategy to complete the authentication.

I'd like to get some second opinions before continuing to go through the process.

Upvotes: 0

Views: 20

Answers (0)

Related Questions