bugfix: Csrf token should be Secure and httpOnly, but not now

2022-06-18 19:50:00 +08:00 · 2022-06-18 19:50:00 +08:00 · d696a37f48
commit d696a37f48
parent 8b43b87dbb
1 changed files with 1 additions and 1 deletions
--- a/server/web/context/context.go
+++ b/server/web/context/context.go
@ -270,7 +270,7 @@ func (ctx *Context) XSRFToken(key string, expire int64) string {
 		if !ok {
 			token = string(utils.RandomCreateBytes(32))
 			// TODO make it configurable
-			ctx.SetSecureCookie(key, "_xsrf", token, expire, "/", "")
+			ctx.SetSecureCookie(key, "_xsrf", token, expire, "/", "", true, true)
 		}
 		ctx._xsrfToken = token
 	}