AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-26 18:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set SameSite=Lax on the session cookie

Browse Source 
Applied at all seven session_start sites. keepalive.php and guest_post.php
had no cookie flags at all and now set httponly and secure too.
This commit is contained in:
johnnyq
2026-07-24 14:09:52 -04:00
parent 3549c2ef2a
commit 565aff35f6
7 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
guest/guest_post.php
View File

@@ -4,6 +4,11 @@ require_once "../config.php";
require_once "../functions.php";
require_once "../includes/load_global_settings.php";
ini_set("session.cookie_httponly", true);
ini_set("session.cookie_samesite", "Lax");
if ($config_https_only) {
ini_set("session.cookie_secure", true);
}
session_start();
require_once "../includes/inc_set_timezone.php"; // Must be included after session_start to work