set-cookie: vwr=...; Path=/; Max-Age=31536000; HttpOnly; SameSite=Lax - no Secure flag. All current deployments are HTTPS-only so impact is defense-in-depth only, but the cookie would be sent over http:// if a user ever hits a non-TLS listener.
Found during exploratory security/bug pass on palette-dev (2026-09-09). Reporting only, no fix attached.
set-cookie: vwr=...; Path=/; Max-Age=31536000; HttpOnly; SameSite=Lax - no Secure flag. All current deployments are HTTPS-only so impact is defense-in-depth only, but the cookie would be sent over http:// if a user ever hits a non-TLS listener.
### Repro
```
curl -sk --resolve palette-dev.archfox.org:443:10.0.1.47 -D- -o /dev/null https://palette-dev.archfox.org/new | grep -i set-cookie
Expected: ...; Secure; HttpOnly; SameSite=Lax
Actual: no Secure attribute.
```
Found during exploratory security/bug pass on palette-dev (2026-09-09). Reporting only, no fix attached.
fen
added spent time 5 seconds2026-09-10 03:49:08 +00:00
fen
added the Low label 2026-09-10 03:49:49 +00:00
Fix proposal (trivial): set the Secure attribute on the vwr viewer cookie (the dev site is HTTPS-only behind Traefik; keep SameSite=Lax). One-line change in the cookie-setting helper.
Fix proposal (trivial): set the Secure attribute on the vwr viewer cookie (the dev site is HTTPS-only behind Traefik; keep SameSite=Lax). One-line change in the cookie-setting helper.
fen
added spent time 5 seconds2026-09-10 13:30:39 +00:00
fen
added the In Progress label 2026-09-10 13:30:39 +00:00
QA passed on live palette-dev (image sha256:7dad5f69..., merge commit ca77250 on dev).
Live Set-Cookie for vwr now carries Secure: vwr=...; Path=/; Max-Age=31536000; HttpOnly; Secure; SameSite=Lax.
Viewer functionality intact: existing vwr accepted (no re-mint), view_count dedupe per vwr (#95) still works, /api/mine and paste views 200 with cookie session.
Unit test coverage added in PR (TestViewerCookieAttributes) verifies HttpOnly/Path/SameSite/Secure.
Closing, branch deleted.
QA passed on live palette-dev (image sha256:7dad5f69..., merge commit ca77250 on dev).
- Live Set-Cookie for vwr now carries Secure: `vwr=...; Path=/; Max-Age=31536000; HttpOnly; Secure; SameSite=Lax`.
- Viewer functionality intact: existing vwr accepted (no re-mint), view_count dedupe per vwr (#95) still works, /api/mine and paste views 200 with cookie session.
- Unit test coverage added in PR (TestViewerCookieAttributes) verifies HttpOnly/Path/SameSite/Secure.
Closing, branch deleted.
fen
added spent time 25 seconds2026-09-10 13:46:18 +00:00
fen
added spent time 44 minutes2026-09-10 13:54:10 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
set-cookie: vwr=...; Path=/; Max-Age=31536000; HttpOnly; SameSite=Lax - no Secure flag. All current deployments are HTTPS-only so impact is defense-in-depth only, but the cookie would be sent over http:// if a user ever hits a non-TLS listener.
Repro
Found during exploratory security/bug pass on palette-dev (2026-09-09). Reporting only, no fix attached.
Fix proposal (trivial): set the Secure attribute on the vwr viewer cookie (the dev site is HTTPS-only behind Traefik; keep SameSite=Lax). One-line change in the cookie-setting helper.
QA passed on live palette-dev (image sha256:7dad5f69..., merge commit
ca77250on dev).vwr=...; Path=/; Max-Age=31536000; HttpOnly; Secure; SameSite=Lax.Closing, branch deleted.