search

julianlam / nodebb-plugin-session-sharing

Allows login sessions from your app to persist in NodeBB
MIT License
86 stars 66 forks source link

httpOnly is false when HTTPS #119

Closed realorbit closed 2 years ago

realorbit commented 2 years ago

Current behaviour is that HttpOnly is only true, if request is not encrypted, i.e. HTTP. Issue with wich is that cookie is set and removed from Google Chrome, if HttpOnly is false. Meaning, whenever cookie is requested by HTTPS, the cookie is not visible to client.

Solution is to always set HttpOnly to true. This should also serve as a security improvement.

https://github.com/julianlam/nodebb-plugin-session-sharing/blob/877b39169ce01de9d30008af8c77b1f0073ed16b/library.js#L599

julianlam commented 2 years ago

This is weird, I wonder why that is. It almost looks like my understanding of httpOnly is incorrect... like I thought it stood for the opposite of secure.

Anyway, httpOnly should be always enabled.

julianlam commented 2 years ago

v5.1.7