Sets Secure on the vwr viewer cookie in viewerCookieMiddleware (the only site that sets vwr; all other set-cookie sites are pw_/tok_ cookies, untouched per issue scope).
All deployments are HTTPS-only behind traefik, so this is defense-in-depth: the cookie will no longer be sent if a user ever hits a plain-HTTP listener. Tradeoff: local dev/tests over plain HTTP will not round-trip the cookie in clients, so the new test (TestViewerCookieAttributes) asserts the Set-Cookie attributes directly rather than relying on cookie round-tripping.
Sets `Secure` on the vwr viewer cookie in `viewerCookieMiddleware` (the only site that sets vwr; all other set-cookie sites are pw_/tok_ cookies, untouched per issue scope).
All deployments are HTTPS-only behind traefik, so this is defense-in-depth: the cookie will no longer be sent if a user ever hits a plain-HTTP listener. Tradeoff: local dev/tests over plain HTTP will not round-trip the cookie in clients, so the new test (`TestViewerCookieAttributes`) asserts the Set-Cookie attributes directly rather than relying on cookie round-tripping.
Fixes #138
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Sets
Secureon the vwr viewer cookie inviewerCookieMiddleware(the only site that sets vwr; all other set-cookie sites are pw_/tok_ cookies, untouched per issue scope).All deployments are HTTPS-only behind traefik, so this is defense-in-depth: the cookie will no longer be sent if a user ever hits a plain-HTTP listener. Tradeoff: local dev/tests over plain HTTP will not round-trip the cookie in clients, so the new test (
TestViewerCookieAttributes) asserts the Set-Cookie attributes directly rather than relying on cookie round-tripping.Fixes #138
b65dd0a24fto521b6f8011