From 8562c05d3bc11b55edeff0d813552b83bf819fb2 Mon Sep 17 00:00:00 2001
From: Alexandre Aubin <alex.aubin@mailoo.org>
Date: Fri, 27 Aug 2021 22:45:59 +0200
Subject: [PATCH] Add httponly to API cookies

---
 moulinette/interfaces/api.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/moulinette/interfaces/api.py b/moulinette/interfaces/api.py
index c7b929c1..baf8d2f6 100644
--- a/moulinette/interfaces/api.py
+++ b/moulinette/interfaces/api.py
@@ -243,6 +243,8 @@ class Session:
             infos,
             secure=True,
             secret=Session.secret,
+            httponly=True,
+            # samesite="strict", # Bottle 0.12 doesn't support samesite, to be added in next versions
         )
 
     def get_infos():