Application Platform Secure cookie

Hello Dimitry,

It’s great to see you focusing on the security aspects of your application, especially concerning secure cookies. You’ve touched on an important point regarding how frontend and backend components communicate in a cloud environment like the DigitalOcean App Platform.

On the DigitalOcean App Platform, HTTPS is enabled by default for all applications, and there isn’t an option to disable HTTPS. This means all external traffic to your application components, including both frontend and backend, is secured using HTTPS.

Also, to clarify the nature of the interaction between the frontend and backend in this context. The frontend code (HTML, JavaScript, CSS, etc.) runs in the client’s browser and makes requests to the backend over the internet. This communication does happen over HTTPS by default when your services are exposed to the internet. Therefore, secure cookies should work correctly as long as the browser can establish a secure HTTPS connection to the backend service.

The communication between the frontend and the backend service would not go over the internal network, here is a quick diagram to showcase how this would usually work:

Internet Users
       ||
       \/
[User's Browser] --- HTTPS Request ----> [DigitalOcean App Platform]
       |                                       |
       | (1) Fetch Frontend over HTTPS         |
       |                                       |
       |                                       |
       | (2) Frontend (HTML, JS, CSS) loaded   |
       |                                       |
       |                                       |
       | (3) Browser executes JS and makes     |
             HTTPS request to Backend          |
       |                                       |
       |                                       |
       |                                       |
       \---<-----------------------------[Frontend Service]
                                           /       \
                                          /         \
                                         /           \
                                        /             \
                           HTTPS Request              HTTPS Request
                                  /                          \
                                 /                            \
                                /                              \
                               \/                              \/
                       [Backend Service]                [Other Services]
                      (APIs, Databases, etc.)         (e.g., Authentication)

Here is also what you could consider:

1. Since the App Platform automatically secures connections with HTTPS, make sure your frontend code references the backend service using the HTTPS protocol. This is typically straightforward but do verify that any URLs to backend services in your frontend code start with https://.

2. When you set cookies with the Secure attribute from your backend, ensure that the domain and path set for the cookies correctly match the requests being made from the frontend. Mismatches here could prevent cookies from being sent correctly.

3. If your frontend and backend are under different domains or subdomains, ensure your CORS policy on the backend is configured to allow requests from your frontend domain. This is essential for secure, cross-domain requests and for cookies to be sent and received correctly.

Given the secure, HTTPS-enabled environment on the DigitalOcean App Platform, the issue with secure cookies not being sent is likely related to the configuration on the client-side or specific settings in your backend service. Double-check your service configurations, cookie attributes, and how your frontend code makes requests to your backend to ensure compatibility with secure cookie transmission.

If you encounter specific issues or need further assistance, feel free to share more details here!

Best of luck with your application deployment!

Best,

Bobby