update auth cookie settings

webcontroller/templates.go

@@ -64,7 +64,10 @@ func (wc *WebController) newTemplateData(w http.ResponseWriter, r *http.Request)
 			log.Debug("Session check for key '%s' failed: %s", key, err)
 
 			if err.Error() == "authentication_required" || err.Error() == "authentication_failed" {
-				// This key is invalid, delete it
+				// Disable API authentication
+				t.PixelAPI.APIKey = ""
+
+				// Remove the authentication cookie
 				log.Debug("Deleting invalid API key")
 				http.SetCookie(w, &http.Cookie{
 					Name:    "pd_auth_key",

webcontroller/user_account.go

@@ -173,11 +173,13 @@ func (wc *WebController) loginForm(td *TemplateData, r *http.Request) (f Form) {
 			f.SubmitSuccess = true
 			f.SubmitMessages = []template.HTML{"Success!"}
 			f.Extra.SetCookie = &http.Cookie{
-				Name:    "pd_auth_key",
-				Value:   loginResp.APIKey,
-				Path:    "/",
-				Expires: time.Now().AddDate(50, 0, 0),
-				Domain:  wc.sessionCookieDomain,
+				Name:     "pd_auth_key",
+				Value:    loginResp.APIKey,
+				Path:     "/",
+				Expires:  time.Now().AddDate(50, 0, 0),
+				Domain:   wc.sessionCookieDomain,
+				SameSite: http.SameSiteStrictMode,
+				Secure:   true,
 			}
 			f.Extra.RedirectTo = "/user"
 		}