feat: do not allow js to access cookie

1 files changed, 7 insertions, 7 deletions

diff --git a/pkg/web/cookie/new.go b/pkg/web/cookie/new.go
index 2809640..335b305 100644
--- a/pkg/web/cookie/new.go
+++ b/pkg/web/cookie/new.go
@@ -9,13 +9,13 @@ import (
 
 func New(name, value string, expires time.Time) *http.Cookie {
 	return &http.Cookie{
-		Name:    name,
-		Value:   value, // TODO:: digitally sign the value
-		Expires: expires,
-		MaxAge:  int(time.Until(expires).Seconds()),
-		Path:    "/",
-		// HttpOnly: true,
-		// Secure:   true,
+		Name:     name,
+		Value:    value, // TODO:: digitally sign the value
+		Expires:  expires,
+		MaxAge:   int(time.Until(expires).Seconds()),
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   true,
 		SameSite: http.SameSiteDefaultMode,
 		Domain:   env.Fetch("HOST", "localhost"),
 	}