"Cannot send secure cookie over unencrypted connection" in Strapi
Blog post from Strapi
Strapi’s “Cannot send secure cookie over unencrypted connection” error commonly occurs when HTTPS is terminated at a reverse proxy while Strapi receives the proxied request over HTTP and therefore does not recognize the original connection as secure. In Strapi 5, configuring `proxy.koa: true` enables Koa to trust headers such as `X-Forwarded-Proto`, but the proxy must also send those headers; this differs from Strapi 4, where proxy support used a top-level boolean, making outdated configurations a frequent migration issue. Administrators should rebuild after changing server configuration and verify behavior through request headers, login testing, or temporary protocol logging. Disabling secure cookies is discouraged because it exposes session tokens over HTTP; instead, TLS and forwarded-protocol handling should be configured correctly. The guidance also recommends bounding trusted forwarded IP addresses with `maxIpsCount` to prevent spoofing and ensure reliable rate limits, allowlists, and logs. Proper proxy configuration additionally corrects public URLs, authentication callbacks, client IP detection, and secure admin login behavior, while blank admin panels referencing localhost may indicate a separate build-time public URL issue.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.