update auth cookie settings

2020-02-05 11:35:31 +01:00
parent 2fba11269a
commit 650c7ede6c
4 changed files with 21 additions and 16 deletions
--- a/webcontroller/user_account.go
+++ b/webcontroller/user_account.go
@@ -173,11 +173,13 @@ func (wc *WebController) loginForm(td *TemplateData, r *http.Request) (f Form) {
 			f.SubmitSuccess = true
 			f.SubmitMessages = []template.HTML{"Success!"}
 			f.Extra.SetCookie = &http.Cookie{
-				Name:    "pd_auth_key",
-				Value:   loginResp.APIKey,
-				Path:    "/",
-				Expires: time.Now().AddDate(50, 0, 0),
-				Domain:  wc.sessionCookieDomain,
+				Name:     "pd_auth_key",
+				Value:    loginResp.APIKey,
+				Path:     "/",
+				Expires:  time.Now().AddDate(50, 0, 0),
+				Domain:   wc.sessionCookieDomain,
+				SameSite: http.SameSiteStrictMode,
+				Secure:   true,
 			}
 			f.Extra.RedirectTo = "/user"
 		}