We have a Java web application that uses security very similar to examples provided by Microsoft for authentication (Microsoft Authentication Library).

We use Payara Enterprise as our Java application server. Our code and configuration works perfectly on our developer machines using localhost and Payara as the web server. However, once we move our app to our corporate servers running NGINX as the reverse proxy, we notice a problem.

Before redirecting to Microsoft online to handle the authentication, we establish a session with our server. After the redirect returns from Microsoft, it creates a NEW session instead of maintaining the original. This behavior causes a failure since the process is looking for attributes set in the original session.

We’ve narrowed this down to a misconfiguration and misunderstanding of our NGINX setup, which is quite simple:

location / {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_cookie_path ~*^/.* /;
    proxy_cookie_flags ~ secure samesite=strict;

    proxy_pass http://our-payara-instance:28080;
    
    # Limit HTTP methods
    limit_except GET POST PUT DELETE {deny all;}
    
    # Enable WebSocket support
    proxy_http_version 1.1; # Use HTTP/1.1 for proxying
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

We have tried different suggestions in the NGINX config, but we haven’t found the correct setting to maintain this session, assuming this is possible.