title: CSURF not working if the Session cookie is secure
body: <p>I am stumped as to when I set the cookie to secure, the csrf of node is not working.</p>
  
  <pre><code>//Load Cooike Parser
  app.use(cookieParser(secret));
  //Load Session Store
  app.use(require('express-session')({
      secret:secret,
      cookie:{
          maxAge: 1000 * 60 * 60 * 24, // 1 day,
          secure: true,
          httpOnly: true
      },
      store: sessionStore
  }));
  //Load POST data parser
  //Form sent should be in JSON format
  app.use(bodyParser.json());
  
  //Initiate CSRF on middleware
  //set the CSRF cookie Header
  app.use(csrf());
  app.use(function(req,res,next){
      res.cookie('XSRF-TOKEN',req.csrfToken());
      next();
  });
  </code></pre>
  
  <p>This setup is using MongoDB for storing the session data. Reading on the <code>express-session</code> docs, I come across to this ...</p>
  
  <blockquote>
    <p>Please note that secure: true is a recommended option. <strong>However, it requires an https-enabled website</strong>, i.e., HTTPS is necessary for secure cookies. If secure is set, and you access your site over HTTP, the cookie will not be set. If you have your node.js behind a proxy and are using secure: true, you need to set "trust proxy" in express:</p>
  </blockquote>
  
  <p><em>Source:</em> <a href="https://www.npmjs.com/package/express-session" rel="nofollow">npm express-session</a></p>
  
  <p>I'm currently running the site locally, so it's not HTTPS. I would like to know is how does <code>secure:true</code> relate to the not passing the csrf test?</p>