[PR #4706] [MERGED] Make cookies HttpOnly and obey COOKIE_SECURE flag #17466

New Issue

GiteaMirror · 2025-11-02T13:33:39-06:00

GiteaMirror commented

2025-11-02 13:33:39 -06:00

📋 Pull Request Information

Original PR: https://github.com/go-gitea/gitea/pull/4706
Author: @SagePtr
Created: 8/14/2018
Status: ✅ Merged
Merged: 8/14/2018
Merged by: @lafriks

Base: master ← Head: cookies

📝 Commits (2)

3cc78ac Make cookies HttpOnly and obey COOKIE_SECURE flag
3221661 Merge branch 'master' into cookies

📊 Changes

4 files changed (+26 additions, -25 deletions)

View changed files

📝 routers/routes/routes.go (+7 -6)
📝 routers/user/auth.go (+16 -16)
📝 routers/user/auth_openid.go (+2 -2)
📝 routers/user/setting/profile.go (+1 -1)

📄 Description

In case of XSS attack (for example, shown in #4703)

This will not fully protect from XSS, but at least won't let rogue script to steal user's cookies.

Additionaly, COOKIE_SECURE config value now is applied to remember user cookies as well, making them not to leak on plain HTTP website (if such attack is possible).

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-gitea/gitea/pull/4706 **Author:** [@SagePtr](https://github.com/SagePtr) **Created:** 8/14/2018 **Status:** ✅ Merged **Merged:** 8/14/2018 **Merged by:** [@lafriks](https://github.com/lafriks) **Base:** `master` ← **Head:** `cookies` --- ### 📝 Commits (2) - [`3cc78ac`](https://github.com/go-gitea/gitea/commit/3cc78ac52deae9e4b2dd120b33c59f6419b6558f) Make cookies HttpOnly and obey COOKIE_SECURE flag - [`3221661`](https://github.com/go-gitea/gitea/commit/322166126e60075b4de4cf4928483d1ceb54f309) Merge branch 'master' into cookies ### 📊 Changes **4 files changed** (+26 additions, -25 deletions) <details> <summary>View changed files</summary> 📝 `routers/routes/routes.go` (+7 -6) 📝 `routers/user/auth.go` (+16 -16) 📝 `routers/user/auth_openid.go` (+2 -2) 📝 `routers/user/setting/profile.go` (+1 -1) </details> ### 📄 Description In case of XSS attack (for example, shown in #4703) This will not fully protect from XSS, but at least won't let rogue script to steal user's cookies. Additionaly, COOKIE_SECURE config value now is applied to remember user cookies as well, making them not to leak on plain HTTP website (if such attack is possible). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-02 13:33:40 -06:00

GiteaMirror closed this issue

2025-11-02 13:33:42 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#17466