Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

<@U02B96E9ASK> hm, it should be set to secure false in that case

im using helm to deploy with the following:
```...
image:
  repository: oryd/kratos
  tag: v0.8.0-alpha.2
  pullPolicy: IfNotPresent
kratos:
  autoMigrate: true
  development: true
  config:
    dev: true
    version: v0.8.0-alpha.2
...```

hm, that’s strange - without direct access to the system I can’t really say. but you’re right, the secure flag should be omitted :confused:

here is the setcookie:
```set-cookie: ory_kratos_session=xxx Max-Age=86400; Path=/; Expires=Fri, 29 Oct 2021 14:18:33 GMT; HttpOnly; Secure; SameSite=Lax```

maybe try and reproduce it locally without helm for now and see what happens

could u link the part of the code that conditionally adds Secure :slightly_smiling_face: ?

I’d recommend looking into the helm chart first

because the code in kratos itself is end-to-end tested

nevermind, seems I was setting the wrong env variable in kratos-react-next, and was prolly requesting the cloud krator :slightly_smiling_face: