Cookie flexibility and SameSite flag #728

New Issue

2026-10-05T04:41:14+02:00

adam commented

2026-10-05 04:41:14 +02:00

Right now in src/HTTPSock.cpp we have:

for (const auto& it : m_msResponseCookies) {
    Write("Set-Cookie: " + it.first.Escape_n(CString::EURL) + "=" +
              it.second.Escape_n(CString::EURL) + "; HttpOnly; path=/;" +
              (GetSSL() ? "Secure;" : "") + "\r\n");
}

Couple of thoughts:

It'd be nice for modules to choose whether their cookies are HttpOnly or not, for instance to allow JavaScript to interact with non-sensitive cookies in their webadmin templates.
It'd be nice to see a SameSite=strict flag here, especially for the session cookie, as an extra defense against CSRF.

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/40218558-cookie-flexibility-and-samesite-flag?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github).

Right now in `src/HTTPSock.cpp` we have: ``` cpp for (const auto& it : m_msResponseCookies) { Write("Set-Cookie: " + it.first.Escape_n(CString::EURL) + "=" + it.second.Escape_n(CString::EURL) + "; HttpOnly; path=/;" + (GetSSL() ? "Secure;" : "") + "\r\n"); } ``` Couple of thoughts: - It'd be nice for modules to choose whether their cookies are HttpOnly or not, for instance to allow JavaScript to interact with non-sensitive cookies in their webadmin templates. - It'd be nice to see a `SameSite=strict` flag here, especially for the session cookie, as an extra defense against CSRF. <bountysource-plugin> --- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/40218558-cookie-flexibility-and-samesite-flag?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin>

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#728