# Setting sameSiteCookies to None while kibana being behind a reverse proxy

**URL:** <https://discuss.elastic.co/t/setting-samesitecookies-to-none-while-kibana-being-behind-a-reverse-proxy/323877>\
**Category:** Kibana\
**Created:** [January 25, 2023, 3:58am UTC](https://discuss.elastic.co/t/setting-samesitecookies-to-none-while-kibana-being-behind-a-reverse-proxy/323877 "2023-01-25T03:58:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vangap](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vangap/32/44927_2.png) [@vangap](https://discuss.elastic.co/u/vangap)\
**Post date:** [January 25, 2023, 3:58am UTC](https://discuss.elastic.co/t/setting-samesitecookies-to-none-while-kibana-being-behind-a-reverse-proxy/323877/1 "2023-01-25T03:58:03Z")

</div>

I have kibana running with SSL disabled and a reverse proxy (nginx) to do the SSL termination.  
I also have xpack.security.sameSiteCookies: "None" which seems ot be causing issues with below error.  
Is there a way to tell Kibana to ignore this or have it rely on X-Forwarded-Proto? From the security pov, this shouldn't be an issue since we have SSL from client browser to the server.

```auto
[2023-01-25T03:57:03.601+00:00][ERROR][http.server.Kibana] Error: "SameSite: None" requires Secure connection
    at validateOptions (/usr/share/kibana/node_modules/@kbn/core-http-server-internal/target_node/cookie_session_storage.js:65:11)
    at createCookieSessionStorageFactory (/usr/share/kibana/node_modules/@kbn/core-http-server-internal/target_node/cookie_session_storage.js:80:3)
    at HttpServer.createCookieSessionStorageFactory (/usr/share/kibana/node_modules/@kbn/core-http-server-internal/target_node/http_server.js:402:103)
    at createCookieSessionStorageFactory (/usr/share/kibana/node_modules/@kbn/core-http-server-internal/target_node/http_server.js:124:64)
    at new SessionCookie (/usr/share/kibana/x-pack/plugins/security/server/session_management/session_cookie.js:45:38)
    at SessionManagementService.setup (/usr/share/kibana/x-pack/plugins/security/server/session_management/session_management_service.js:53:26)
    at SecurityPlugin.setup (/usr/share/kibana/x-pack/plugins/security/server/plugin.js:191:35)
    at PluginWrapper.setup (/usr/share/kibana/src/core/server/plugins/plugin.js:91:26)
    at PluginsSystem.setupPlugins (/usr/share/kibana/src/core/server/plugins/plugins_system.js:96:40)
    at PluginsService.setup (/usr/share/kibana/src/core/server/plugins/plugins_service.js:125:52)
    at Server.setup (/usr/share/kibana/src/core/server/server.js:345:26)
    at Root.setup (/usr/share/kibana/src/core/server/root/index.js:58:14)
    at bootstrap (/usr/share/kibana/src/core/server/bootstrap.js:119:5)
    at Command.<anonymous> (/usr/share/kibana/src/cli/serve/serve.js:216:5)

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2023, 3:58am UTC](https://discuss.elastic.co/t/setting-samesitecookies-to-none-while-kibana-being-behind-a-reverse-proxy/323877/2 "2023-02-22T03:58:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.