Commit62dc831

authored

fix: use httponly flag on coder_signed_app_token cookie (#18989)

1 parentc4b69bb commit62dc831Copy full SHA for 62dc831

File tree

-4

lines changed

-4

lines changed

Lines changed: 5 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -77,10 +77,11 @@ func ResolveRequest(rw http.ResponseWriter, r *http.Request, opts ResolveRequest`
`77`	`77`	`// For subdomain apps, this applies to the entire subdomain, e.g.`
`78`	`78`	`// app--agent--workspace--user.apps.example.com`
`79`	`79`	`http.SetCookie(rw,opts.CookieCfg.Apply(&http.Cookie{`
`80`		`-Name:codersdk.SignedAppTokenCookie,`
`81`		`-Value:tokenStr,`
`82`		`-Path:appReq.BasePath,`
`83`		`-Expires:token.Expiry.Time(),`
	`80`	`+Name:codersdk.SignedAppTokenCookie,`
	`81`	`+Value:tokenStr,`
	`82`	`+Path:appReq.BasePath,`
	`83`	`+HttpOnly:true,`
	`84`	`+Expires:token.Expiry.Time(),`
`84`	`85`	`}))`
`85`	`86`
`86`	`87`	`returntoken,true`

Comments

(0)