From e77e7b165ac4920290015ec4b95e651730009edc Mon Sep 17 00:00:00 2001 From: David Mehren Date: Mon, 8 Jun 2020 15:27:31 +0200 Subject: Set all cookies with sameSite: strict Modern browsers do not support (or will stop supporting) sameSite: none (or no sameSite attribute) without the Secure flag. As we don't want everyone to be able to make requests with our cookies anyway, this commit sets sameSite to strict. See https://developer.mozilla.org/de/docs/Web/HTTP/Headers/Set-Cookie/SameSite Signed-off-by: David Mehren --- public/js/index.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'public/js/index.js') diff --git a/public/js/index.js b/public/js/index.js index de3c8a6d..ad20ffff 100644 --- a/public/js/index.js +++ b/public/js/index.js @@ -1596,7 +1596,8 @@ function toggleNightMode () { store.set('nightMode', !isActive) } else { Cookies.set('nightMode', !isActive, { - expires: 365 + expires: 365, + sameSite: 'strict' }) } } -- cgit v1.2.3