Set HttpOnly and Secure cookies in logout cookies

Signed-off-by: Eduardo Apolinario <[email protected]>
flyteorg · Oct 24, 2024 · cae154c · cae154c
1 parent 056749c
commit cae154c
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/flyteadmin/auth/cookie.go b/flyteadmin/auth/cookie.go
@@ -128,6 +128,7 @@ func NewCsrfCookie() http.Cookie {
 		Value:    csrfStateToken,
 		SameSite: http.SameSiteLaxMode,
 		HttpOnly: true,
+		Secure:   true,
 	}
 }
 

diff --git a/flyteadmin/auth/cookie_manager.go b/flyteadmin/auth/cookie_manager.go
@@ -218,6 +218,7 @@ func (c *CookieManager) getLogoutCookie(name string) *http.Cookie {
 		Domain:   c.domain,
 		MaxAge:   0,
 		HttpOnly: true,
+		Secure: true,
 		Expires:  time.Now().Add(-1 * time.Hour),
 	}
 }