administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-10-20 05:32:49 +03:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

set the secure cookie flag when the request arrived over tls

Browse Source 
The session cookie only got the Secure flag from auth.cookie_secure, which defaults to false even though TLS is on by default, so browsers would send it over plain HTTP. The cookie is now Secure whenever nginx reports an https scheme, and nginx passes that scheme to the /auth subrequest so refreshed cookies match. cookie_secure still forces the flag for a reverse proxy that terminates TLS in front of plain-HTTP Frigate.
This commit is contained in:
Josh Hawkins
2026-10-18 12:18:58 -05:00
parent 3dc382938c
commit a2e7e5c991
6 changed files with 58 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/docs/configuration/advanced/reference.md
+2 -1
View File
@@ -117,7 +117,8 @@ auth:
# Optional: Cookie to store the JWT token for native auth (default: shown below)
cookie_name: frigate_token
# Optional: Set secure flag on cookie. (default: shown below)
# NOTE: This should be set to True if you are using TLS
# NOTE: Frigate sets the flag automatically when serving TLS. Set this to True
# when a reverse proxy terminates TLS in front of Frigate
cookie_secure: False
# Optional: Session length in seconds (default: shown below)
session_length: 86400 # 24 hours