🤗 why it's not possible to set cookie for CSRF middleware expire date to session?

[Makemanback]

Hello. Why in https://docs.gofiber.io/api/middleware/csrf middleware impossible to set session cookie? In secure context from XXS/CSRF attacks session cookies are more secure.

Or is it possible to set cookies as session in this middleware?

If I set Expiration as 0, Expiration field goes to header, but if I want to make cookies as session I should not set headers Max-Age and Expires.

Session cookie - https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#define_the_lifetime_of_a_cookie

[welcome]

Thanks for opening your first issue here! 🎉 Be sure to follow the issue template! If you need help or want to chat with us, join us on Discord https://gofiber.io/discord

[ReneWerner87]

https://github.com/gofiber/fiber/blob/master/middleware/csrf/csrf.go#L73
@Makemanback
yes i see that should be added if necessary, not a bad idea, if we can make the configuration understandable for this setting, then happy to do so

pull requests are welcome

[abhi12299]

@ReneWerner87 we could have a field named SessionOnly or something similar which if true will ignore max age and expires header. How does that sound? I could work on this.

[ReneWerner87]

Sounds okay.