Why no "secure=true" on nginx proxy to Confluence?

In this document :
https://confluence.atlassian.com/doc/running-confluence-behind-nginx-with-ssl-858772080.html

It specifically says to avoid setting secure=true. However, that can leave you open to malicious networks stealing your JSESSIONID cookies and impersonating your session.

Why should we not set secure on the tomcat connector? Is it possible to get nginx to secure the cookie somehow instead?

1 answer

0 vote
Ann Worley Atlassian Team Jun 23, 2017

The communication on the Tomcat connector (port 8090 in the example) is not secure, as it is only set up for communication between NGINX and Confluence. The client traffic is not received over that port. The proxy serves the content over SSL so the connections to the client are encrypted. The documentation you linked assumes the proxy is running on the same host as Confluence, and mentions that the NGINX>Confluence traffic is unencrypted:

  • "External client connections with NGINX are secured using SSL. Connections between NGINX and Confluence Server are unsecured.
  • Confluence Server and NGINX run on the same machine."

 

Thanks for the explanation of how secure proxies work but the secure flag on the connector has little relevance to what you've explained. 

It does mean that the cookie is delivered without the secure flag and can be extracted by malicious networks. 

I note the example also has SSLv2 enabled, which was deprecated 6 years before Atlassian was founded.

Suggest an answer

Log in or Sign up to answer
How to earn badges on the Atlassian Community

How to earn badges on the Atlassian Community

Badges are a great way to show off community activity, whether you’re a newbie or a Champion.

Learn more
Community showcase
Posted Jul 10, 2018 in Confluence

We want to see the templates you've created in Confluence!

Hi Community, Jessica here from the Confluence Product Marketing team!  July’s community challenge is all about sharing pictures  — and as an extension of our first post on what ...

869 views 23 12
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you