Session now respects the http_only config option (#13825)

laravel · Jun 2, 2016 · bf05d24 · bf05d24
1 parent c9d9748
commit bf05d24
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/Illuminate/Session/Middleware/StartSession.php b/src/Illuminate/Session/Middleware/StartSession.php
@@ -180,7 +180,8 @@ protected function addCookieToResponse(Response $response, SessionInterface $ses
         if ($this->sessionIsPersistent($config = $this->manager->getSessionConfig())) {
             $response->headers->setCookie(new Cookie(
                 $session->getName(), $session->getId(), $this->getCookieExpirationDate(),
-                $config['path'], $config['domain'], Arr::get($config, 'secure', false)
+                $config['path'], $config['domain'], Arr::get($config, 'secure', false),
+                Arr::get($config, 'http_only', true)
             ));
         }
     }