element-hq / element-hq/matrix-authentication-service
Prefix cookies with `__Host-`
Open
- Dominant language
- Rust
- Stars
- 280
- Forks
- 111
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 25
Description
We should prefix all our cookies with `__Host-`:
> __Host- prefix: Cookies with names starting with __Host- are sent only to the host subdomain or domain that set them, and not to any other host. They must be set with the secure flag, must be from a secure page (HTTPS), must not have a domain specified, and the path must be /.
Contributor guide
Assessment
This issue has not been assessed yet.