fix(security): add Secure flag to CSRF cookie on HTTPS
The CSRF token cookie is set without the Secure flag. On HTTPS deployments the cookie could be transmitted over plain HTTP if a mixed-content scenario occurs. Conditionally add the Secure flag when running on HTTPS (window.location.protocol === 'https:'). No impact on HTTP-only deployments. Severity: Low-Medium
Deimos AI committed
Feb 26, 2026 at 13:52 UTC
9e3bbb759f5385a80c1934ccafadfab55fa0e65e
1 file changed
+2
-1
webui/js/api.js
+2
-1
@@ -165,7 +165,8 @@ export async function getCsrfToken() {
165
: null;
166
const cookieRuntimeId = runtimeId || injectedRuntimeId;
167
if (cookieRuntimeId) {
168
- document.cookie = `csrf_token_${cookieRuntimeId}=${csrfToken}; SameSite=Strict; Path=/`;
168
+ const _secureFlag = window.location.protocol === 'https:' ? '; Secure' : '';
169
+ document.cookie = `csrf_token_${cookieRuntimeId}=${csrfToken}; SameSite=Strict; Path=/${_secureFlag}`;
170
} else {
171
console.warn("CSRF runtime id missing; skipping cookie name binding.");
172
}