How to set secure cookie and httponly flag in z2jh

JupyterHub Zero to JupyterHub on Kubernetes
1

Hi,

How can I set httponly flag in cookies in the z2jh yaml values?
this didn’t work

hub:
  config:
    Jupyterhub:
      cookie_options:
         secure: true

and says:

Config option `cookie_options` not recognized by `JupyterHub`

best,

2

Hi,
I was wondering how we can secure _xsrf cookie.
best

3

There’s an example of setting cookie_options in

2 Likes
5

Hello,

This worked for some cookies but _xsrf in the paths /hub and /user/… is still missing attributes secure and httponly. I also tried in my ingress:

nginx.ingress.kubernetes.io/proxy-cookie-path: $uri "/; HTTPOnly; Secure; SameSite=strict"

but that didn’t help either.

would you know how to add secure and httponly attributes to _xsrf cookie as well?

best