AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-29 03:37:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set SameSite=Lax on the session cookie

Browse Source 
Applied at all seven session_start sites. keepalive.php and guest_post.php
had no cookie flags at all and now set httponly and secure too.
This commit is contained in:
johnnyq
2026-07-24 14:09:52 -04:00
parent 3549c2ef2a
commit 565aff35f6
7 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
login.php
View File

@@ -15,6 +15,7 @@ require_once "libs/totp/totp.php";
if (session_status() === PHP_SESSION_NONE) {
ini_set("session.cookie_httponly", true);
ini_set("session.cookie_samesite", "Lax");
if ($config_https_only || !isset($config_https_only)) {
ini_set("session.cookie_secure", true);