Add option to remove the 'secure' attribute from cookies

[edmorley]

This allows cookies proxied from HTTPS sites to be used by a non-HTTPS localhost development environment.

A new removeCookieProperty() helper has been added since the existing rewriteCookieProperty():

• can't handle attributes that have no value (since the regex expects an =, and changing that would break the current implemention)
• doesn't really make sense for outright removing an attribute regardless of any value

Fixes #1165.

[edmorley]

The Travis run is failing on node 0.10/0.12, however that's unrelated to this PR - see #1167.

[DaxChen]

👍 +1 for this, any plans if this will be merged and releases?

[fritx]

+1 for PR (option cookieRemoveSecure), duplicated with (for) issue: #1165

Before the PR my current workaround is:

proxyTable: {
  '/api': {
    target: 'https://xxx',
    // https://stackoverflow.com/questions/35686091/how-can-i-proxy-to-a-ssl-endpoint-with-the-webpack-dev-server-proxy
    secure: false,
    changeOrigin: true,
    cookieDomainRewrite: '',
    // https://github.com/nodejitsu/node-http-proxy/pull/1166
    onProxyRes: (proxyRes) => {
      let removeSecure = str => str.replace(/; Secure/i, '')
      let set = proxyRes.headers['set-cookie']
      if (set) {
        let result = Array.isArray(set)
          ? set.map(removeSecure)
          : removeSecure(set)
        proxyRes.headers['set-cookie'] = result
      }
    }
  }
}

[adarshaj]

Looking forward for this one to be merged!

[edmorley]

I've rebased this on master (there were conflicts from the recent merges).

@jcrugzz / @indexzero I don't suppose you could take a look when you have a spare moment? (Tomorrow will be the one-year anniversary of this PR hehe :-))

[edmorley]

@jcrugzz, sorry to pester - but would you mind taking a look at this PR? :-)

[edmorley]

Is there anything we can do to help with the review/merge of this? :-)

[ghost]

There's still people who would like this, any update? :)

[fritx]

Update for previous comment #1166 (comment)

Option 1: remove 'Secure', 'SameSite' from 'set-cookie'

Before the PR my current workaround is:

(Added 'SameSite=None' removal as it requires 'Secure', says MDN)

if we remove 'Secure', 'Samesite' should be removed too

proxyTable: {
  '/api': {
    target: 'https://xxx',
    // https://stackoverflow.com/questions/35686091/how-can-i-proxy-to-a-ssl-endpoint-with-the-webpack-dev-server-proxy
    secure: false,
    changeOrigin: true,
    cookieDomainRewrite: '',
    // https://github.com/nodejitsu/node-http-proxy/pull/1166
    onProxyRes: (proxyRes) => {
      let removeSecure = str => str.replace(/; Secure|; SameSite=None/gi, '')
      let set = proxyRes.headers['set-cookie']
      if (set) {
        let result = Array.isArray(set)
          ? set.map(removeSecure)
          : removeSecure(set)
        proxyRes.headers['set-cookie'] = result
      }
    }
  }
}

---

Option 2: launch an https localhost with webpack-dev-server

// .gitignore
+build/ssl/server.key
+build/ssl/server.cert

// build/dev-server.js
-var uri = 'http://localhost:' + port
+var uri = 'https://localhost:' + port
// ...
-module.exports = app.listen(port, function (err) {
+var server = require('./ssl')(app)
+module.exports = server.listen(port, function (err) {

// build/ssl/http.js
// https://stackoverflow.com/questions/22453782/nodejs-http-and-https-over-same-port
-    server.http = http.createServer(handler);
+    // server.http = http.createServer(handler);
+    server.http = http.createServer((req, res) => {
+      res.writeHead(301, { "Location": "https://" + req.headers['host'] + req.url });
+      res.end();
+    });

// build/ssl/index.js
var cp = require('child_process')
var fs = require('fs')
var http = require('./http')

// turn on https with webpack-dev-server
module.exports = app => {
  try {
    fs.accessSync('build/ssl/server.key')
    fs.accessSync('build/ssl/server.cert')
  } catch (err) { // not exists
    // https://superuser.com/questions/226192/avoid-password-prompt-for-keys-and-prompts-for-dn-information
    cp.execSync(`openssl req \
      -new \
      -newkey rsa:4096 \
      -days 365 \
      -nodes \
      -x509 \
      -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \
      -keyout build/ssl/server.key \
      -out build/ssl/server.cert`)
  }

  // https://stackoverflow.com/questions/30957793/nodejs-ssl-bad-password-read
  var server = http.createServer({
    key: fs.readFileSync('build/ssl/server.key'),
    cert: fs.readFileSync('build/ssl/server.cert')
  }, app)

  return server
}

[4696047344]

Now with the can i say this just a loophole

[4696047344]

Was this subscription before or after my be here. And carry myself highest code of conduct. I do appoligize.

[edmorley]

Closing this PR since I no longer use this project, and want to clean up my PR list (this is the oldest unmerged PR I have, at 6 years old...).