mirror of
https://github.com/hedgedoc/hedgedoc.git
synced 2024-10-20 14:12:10 -04:00
8406f75bb7
While HSTS should take care of most of this, setting cookies to be secure, and only applied on same site helps to improve situations where for whatever reason, downgrade attacks are still a thing. This patch adds the `sameSite` and `secure` to the session cookie and this way prevent all accidents where a browser may doesn't support HSTS or HSTS is intentionally dropped. Reference: https://www.npmjs.com/package/express-session#cookiesecure Signed-off-by: Sheogorath <sheogorath@shivering-isles.com> |
||
|---|---|---|
| .. | ||
| config | ||
| migrations | ||
| models | ||
| ot | ||
| utils | ||
| web | ||
| workers | ||
| app.ts | ||
| csp.ts | ||
| errors.ts | ||
| history.ts | ||
| letter-avatars.ts | ||
| library-ext.d.ts | ||
| logger.ts | ||
| realtime.ts | ||
| response.ts | ||