explicit sameSite=lax for cookie
Massimo Melina committed
Aug 7, 2023 at 19:18 UTC
b2889d3e22780284548f40e4df06493715231cf9
1 file changed
+1
-1
src/index.ts
+1
-1
@@ -26,7 +26,7 @@ process.title = 'HFS ' + VERSION
26
const keys = process.env.COOKIE_SIGN_KEYS?.split(',') || [randomId(30)]
27
export const app = new Koa({ keys })
28
app.use(someSecurity)
29
- .use(session({ key: 'hfs_$id', signed: true, rolling: true }, app))
29
+ .use(session({ key: 'hfs_$id', signed: true, rolling: true, sameSite: 'lax' }, app))
30
.use(prepareState)
31
.use(gzipper)
32
.use(paramsDecoder) // must be done before plugins, so they can manipulate params