fortify cookie security - samesite, secure, explicit httponly

2025-04-24 17:22:35 +02:00 · 2017-01-10 16:43:14 -06:00 · 2017-01-10 16:43:14 -06:00 · 57e31c66e3
commit 57e31c66e3
parent d12dc53631
1 changed files with 4 additions and 1 deletions
--- a/app.rb
+++ b/app.rb
@ -4,7 +4,10 @@ require './app_helpers.rb'
 use Rack::Session::Cookie, key:          'neocities',
                           path:         '/',
                           expire_after: 31556926, # one year in seconds
-                           secret:       $config['session_secret']
+                           secret:       $config['session_secret'],
+                           httponly: true,
+                           same_site: true,
+                           secure: ENV['RACK_ENV'] == 'production'

 use Rack::Recaptcha, public_key: $config['recaptcha_public_key'], private_key: $config['recaptcha_private_key']
 use Rack::TempfileReaper