Would you like to learn how to enable HTTPONLY and SECURE flags on the Nginx server? In this tutorial, we are going to show you how to protect your website Cookies by adding the HTTPONLY and SECURE headers on the Nginx server.
• Ubuntu 18
• Ubuntu 19
• Ubuntu 20
• Nginx 1.18.0
In our example, the Nginx server is hosting the website WWW.GAMEKING.TIPS.
Equipment list
The following section presents the list of equipment used to create this tutorial.
As an Amazon Associate, I earn from qualifying purchases.
Nginx – Related Tutorial:
On this page, we offer quick access to a list of tutorials related to Nginx.
Tutorial Nginx – Enable the HTTPONLY and SECURE headers
Install the Nginx server.
Install the required packages.
Download the latest version of the Nginx module named NGINX_COOKIE_FLAG_MODULE.
Verify the version of Nginx installed on your system.
Here is the command output.
Download the source code of the same version of Nginx installed on your system.
Compile and install the Nginx module.
Edit the Nginx configuration file.
Add the following line in the Nginx configuration file.
Here is the file before our configuration.
Here is the file after our configuration.
Edit the Nginx configuration file for the website.
If your website supports only HTTP, Add the following lines to the configuration file.
If your website supports only HTTPS, Add the following lines to the configuration file.
As an example, here is our configuration file.
Restart the Nginx service.
The HTTPONLY flag increases the COOKIE’s protection, by not allowing access through client-side scripts.
The SECURE flag increases the security even further, by allowing only COOKIE requests through an HTTPS connection.
Create a PHP file to test the HTTPONLY configuration.
Here is the file content.
This test requires that your Nginx server supports PHP.
From a remote Linux computer, try to access this page.
Here is the command output with the flag HTTPONLY enabled.
Here is the command output with the flags HTTPONLY and SECURE enabled.
Congratulations! You are able to enable the flags HTTPONLY and SECURE on the Nginx server.
