Skip to content

Commit

Permalink
oxAuth #412
Browse files Browse the repository at this point in the history 
Support JSON Property for HTTPOnly

To enable it, set sessionStateHttpOnly: true in oxAuth config.

Note that SessionManagement will not work.
See http://openid.net/specs/openid-connect-session-1_0.html

Note that your browser should not allow a client-side script to access the session_state cookie. Unfortunately, since the attribute is relatively new, several browsers may neglect to handle the new attribute properly.
See https://www.owasp.org/index.php/HttpOnly
  • Loading branch information
@qbert2k
qbert2k committed Dec 29, 2016
1 parent e04cc6a commit 3ea1353
Show file tree
Hide file tree
Showing 3 changed files with 48 additions and 160 deletions.
Loading

0 comments on commit 3ea1353

Please sign in to comment.