mirror of
https://github.com/zadam/trilium.git
synced 2025-10-20 23:29:02 +02:00
5f605b3a91
- `sameSite` - previous setting inherited from csurf was to simply not set it at all, which makes all browser nag in their dev console output. They will default to "Lax" for these type of cookies in the future. We can even use "strict" here though for our use case: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value - `httpOnly`: should be enabled for the csrf cookie as well for the session cookie it already is enabled. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#httponly