Closed twoends closed 5 months ago
I just checked and the cookie is never explicitly created as HttpOnly. Is that the default?
Anyways, it should not be HttpOnly, I'll explicitly specify that to make sure this doesn't happen in the future.
I'm not sure setting HttpOnly to false is an acceptable solution.
Having the cookie accessible via JS isn't a concern. It just mirrors document.documentElement.lang
so anyone who wants it's value can just read that instead.
It shouldn't be created as HttpOnly by default. Don't know if some browser policies are getting updated. Btw, tested on Edge, Chrome, Firefox and Safari. Only Safari creates it as non-HttpOnly
Very weird, I'll make sure to test thoroughly test the changes in all browser
In changelog 0.9.3 I see:
def2d4e: fix: Also update the paraglide:lang cookie on the client to allow for better language negotiation
Unfortunately client-side cookie won't update since it's created as HttpOnly. If I manually set HttpOnly to false, clicking
<a href={i18n.route($page.url.pathname)} hreflang={lang}>
will update the cookie correctly.Despite this, I'm not sure setting HttpOnly to false is an acceptable solution.