From 631af1f827312a3de5f9e1a7cc33b13f427ecd27 Mon Sep 17 00:00:00 2001 From: JustSong Date: Sun, 10 Nov 2024 12:27:20 +0800 Subject: [PATCH] feat: set http_only flag for cookie --- main.go | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/main.go b/main.go index a1bba9455..11d91f56a 100644 --- a/main.go +++ b/main.go @@ -58,14 +58,18 @@ func main() { //server.Use(gzip.Gzip(gzip.DefaultCompression)) // conflict with sse // Initialize session store + var store sessions.Store if common.RedisEnabled { opt := common.ParseRedisOption() - store, _ := redis.NewStore(opt.MinIdleConns, opt.Network, opt.Addr, opt.Password, []byte(common.SessionSecret)) - server.Use(sessions.Sessions("session", store)) + store, _ = redis.NewStore(opt.MinIdleConns, opt.Network, opt.Addr, opt.Password, []byte(common.SessionSecret)) } else { - store := cookie.NewStore([]byte(common.SessionSecret)) - server.Use(sessions.Sessions("session", store)) + store = cookie.NewStore([]byte(common.SessionSecret)) } + store.Options(sessions.Options{ + HttpOnly: true, + MaxAge: 30 * 24 * 3600, + }) + server.Use(sessions.Sessions("session", store)) router.SetRouter(server, buildFS, indexPage) var port = os.Getenv("PORT")