mirror of
https://github.com/itflow-org/itflow
synced 2026-07-26 10:17:15 +00:00
Return 403 on CSRF failure instead of a 302, which anything following redirects records as a 200. Set SameSite=Lax at every session_start; keepalive.php and guest_post.php had no cookie flags at all.