mirror of
https://github.com/itflow-org/itflow
synced 2026-09-10 16:55:13 +00:00
Return 403 on CSRF failure instead of a 302, which anything following redirects records as a 200. Set SameSite=Lax at every session_start; keepalive.php and guest_post.php had no cookie flags at all.