title: JSESSIONID cookie is not stored in browser
body: <p>I have a bunch of problems with <strong>JSESSIONID</strong> cookie in different scenarios. I've already read a lot information, but it feels crazy, when things do not work as expected.</p>
  
  <p>Long story short, I have a web server behind proxy server (nginx). Proxy handles requests with HTTPS (and redirects HTTP to HTTPS), also proxy has LDAP authorization (does not matter but anyway).</p>
  
  <p>On the web server machine apache proxy is configured, that redirects from 443(https) to 80 port.
  Web server is Tomcat, it is configured in server.xml to use secure cookies (connector settings).</p>
  
  <p>To summarize</p>
  
  <pre><code>[browser] -----&gt;  [nginx proxy] -----&gt; [tomcat app server]
  </code></pre>
  
  <p>Now problems:</p>
  
  <ol>
  <li><p>When open app from intranet (requests go directly to app server without nginx proxy), cookies are not cached at all. Developer tools show, that response <strong>contains</strong> JSESSIONID cookie, but new requests do not use it and app breaks.</p>
  
  <p><strong>Key moments:</strong> server returns <em>secure</em> cookie</p></li>
  <li><p>When open app from internet (requests go through nginx proxy), cookies are cached. Application works fine. But cookies are <strong>not secure</strong>, though they <strong>might be</strong> (because tomcat is configured and we run through HTTPS).</p></li>
  </ol>
  
  <p>So, I want to understand why cookies are not cached in first case and why cookies are not secure  in second case.</p>
  
  <p><strong>Update</strong></p>
  
  <p>I removed </p>
  
  <pre><code>&lt;session-config&gt;
      &lt;cookie-config&gt;
          &lt;secure&gt;true&lt;/secure&gt;
      &lt;/cookie-config&gt;
  &lt;/session-config&gt;
  </code></pre>
  
  <p>from web.xml (it was intended to make all cookies secure, I found it somewhere in web)</p>
  
  <p>After that, problem 1 was solved (cookies are cached now) and problem 2 is solved too (cookies are secure). 
  Honestly, I don't understand this magic and want to hear some expert explanation.</p>