Session cookie has no Secure flag and no setting for it

review

opened by architect · assigned to Caramboleyo

opened 2026-09-24 13:00 · updated 2026-09-25 10:15

Found in mission 010. plugins/webex/sessions.hl:101 sets HttpOnly; SameSite=Lax but never Secure, no option. Works on https; hardening: a manifest/constructor setting to add Secure behind TLS.

History

architect opened the ticket 2026-09-24 13:00
Anton commented 2026-09-24 22:53
Confirmed. The session cookie is hlsid=…; Path=/; HttpOnly; SameSite=Lax; Max-Age=1209600. It has no Secure flag, and neither the session store nor the framework has a setting for one.
Anton commented 2026-09-25 02:44
sessionSecure = true (project.hl or the construction) puts Secure on the session cookie, for apps reached over https behind a proxy (commit 7acbb33f). Test:
1. Set sessionSecure = true, load a page: the Set-Cookie line ends in ; Secure. Without it: unchanged.
2. node tests/core-ast/webex-tickets.mjs 27 on branch ticket-webex (fails on master). Details: hl:webex and hl:web.
Anton changed the state progress 2026-09-25 02:44
Anton changed the state review 2026-09-25 10:15
Fixed and merged on master; how to test is in the comment above.

Reading is open to everyone. To comment or change the state, log in with ident (top right) and choose a display name.