@W-21066774: Add config flag to enable/disable HttpOnly session cookies#3635
Conversation
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
unandyala
changed the title
vcua-mobify
left a comment
vcua-mobify
left a comment
There was a problem hiding this comment.
I see that this PR is only adding the new httpOnly property and that nothing is really using it yet. I assume that we'll have a follow up PR for those uses?
| ], | ||
| ssrParameters: { | ||
| ssrFunctionNodeVersion: '22.x', | ||
| disableHttpOnlySessionCookies: true, |
There was a problem hiding this comment.
I see that we have true as the default in pwa-kit-dev if this is undefined so we probably don't need to update the config templates in the generator.
Should we have a comment explaining why this is true by default?
There was a problem hiding this comment.
I think it is good to add it for clarity. Also changed value to false
Yes |
| ssrParameters: { | ||
| ssrFunctionNodeVersion: '22.x', | ||
| // Store the session cookies as HttpOnly or enhanced security. | ||
| disableHttpOnlySessionCookies: false, |
There was a problem hiding this comment.
For any new projects, we want to enable HttpOnly cookies by deafult
3 participants
Add config flag to enable/disable HttpOnly session cookies