Merge pull request #1323 from proditis/master

Make our cookies a bit more strict
echoCTF · Nov 20, 2024 · 1ab2ac6 · 1ab2ac6
2 parents 0c97945 + c6d3d5d
commit 1ab2ac6
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/frontend/config/web.php b/frontend/config/web.php
@@ -170,15 +170,22 @@
       'name' => 'red',
       'timeout' => 3600 * 12,
       'cookieParams' => [
+        'secure' => true,
         'sameSite' => 'Strict',
+        'lifetime'=> 3600 * 12,
         'httpOnly' => true
       ],
     ],
     'user' => [
       //'class' => '\app\components\User',
       'identityClass' => '\app\models\Player',
       'enableAutoLogin' => true,
-      'identityCookie' => ['name' => '_identity-red', 'httpOnly' => true, /*'sameSite'=>'Lax'*/],
+      'identityCookie' => [
+        'name' => '_identity-red',
+        'secure' => true,
+        'httpOnly' => true,
+        'sameSite'=>'Strict'
+      ],
     ],
     'errorHandler' => [
       'errorAction' => 'site/error',