It specifically says to avoid setting secure=true. However, that can leave you open to malicious networks stealing your JSESSIONID cookies and impersonating your session.
Why should we not set secure on the tomcat connector? Is it possible to get nginx to secure the cookie somehow instead?
The communication on the Tomcat connector (port 8090 in the example) is not secure, as it is only set up for communication between NGINX and Confluence. The client traffic is not received over that port. The proxy serves the content over SSL so the connections to the client are encrypted. The documentation you linked assumes the proxy is running on the same host as Confluence, and mentions that the NGINX>Confluence traffic is unencrypted:
Do you use templates with Confluence? Take part in a remote 1-hr workshop. You'll receive USD $100 for your time! We're looking for people to participate in a remote 1-hr workshop...
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs