Mozilla just released a new tool to check your website configuration. observatory.mozilla.org
But the scan is complaining about Cookies (-10 points): Session cookie set without the Secure flag ...
Unfortunately the service running behind my nginx can only set the secure header if the SSL terminates there directly and not when SSL terminates on the nginx. Thus the "Secure" flag is not set on the cookies.
Is it possible to append the "secure" flag to the cookies somehow using nginx? Modifing the location/path seems to be possible.