Would you like to learn how to enable HTTPONLY and SECURE flags on the Nginx server? In this tutorial, we are going to show you how to protect your website Cookies by adding the HTTPONLY and SECURE headers on the Nginx server.

• Ubuntu 18
• Ubuntu 19
• Ubuntu 20
• Nginx 1.18.0

In our example, the Nginx server is hosting the website WWW.GAMEKING.TIPS.

Equipment list

The following section presents the list of equipment used to create this tutorial.

As an Amazon Associate, I earn from qualifying purchases.

Tutorial Nginx - Enable the HTTPONLY and SECURE headers

Install the Nginx server.

Copy to Clipboard

Install the required packages.

Copy to Clipboard

Download the latest version of the Nginx module named NGINX_COOKIE_FLAG_MODULE.

Copy to Clipboard

Verify the version of Nginx installed on your system.

Copy to Clipboard

Here is the command output.

Copy to Clipboard

Download the source code of the same version of Nginx installed on your system.

Copy to Clipboard

Compile and install the Nginx module.

Copy to Clipboard

Edit the Nginx configuration file.

Copy to Clipboard

Add the following line in the Nginx configuration file.

Copy to Clipboard

Here is the file before our configuration.

Copy to Clipboard

Here is the file after our configuration.

Copy to Clipboard

Edit the Nginx configuration file for the website.

Copy to Clipboard

If your website supports only HTTP, Add the following lines to the configuration file.

Copy to Clipboard

If your website supports only HTTPS, Add the following lines to the configuration file.

Copy to Clipboard

As an example, here is our configuration file.

Copy to Clipboard

Restart the Nginx service.

Copy to Clipboard

The HTTPONLY flag increases the COOKIE’s protection, by not allowing access through client-side scripts.

The SECURE flag increases the security even further, by allowing only COOKIE requests through an HTTPS connection.

Create a PHP file to test the HTTPONLY configuration.

Copy to Clipboard

Here is the file content.

Copy to Clipboard

This test requires that your Nginx server supports PHP.

From a remote Linux computer, try to access this page.

Copy to Clipboard

Here is the command output with the flag HTTPONLY enabled.

Copy to Clipboard

Here is the command output with the flags HTTPONLY and SECURE enabled.

Copy to Clipboard

Congratulations! You are able to enable the flags HTTPONLY and SECURE on the Nginx server.