fix(sessions): set HttpOnly flag for session cookies

fixes: flatcar#901
ErvinRacz · Feb 6, 2025 · 3b6e8ff · 3b6e8ff
1 parent a86cd19
commit 3b6e8ff
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/backend/pkg/sessions/session.go b/backend/pkg/sessions/session.go
@@ -114,6 +114,7 @@ func (s *Session) Save(writer http.ResponseWriter) error {
 		Value:  value,
 		Path:   "/",
 		MaxAge: maxAge,
+		HttpOnly: true,
 	}
 	http.SetCookie(writer, cookie)
 	return nil