Koa session cookies should be httpOnly.

raveljs · May 24, 2016 · 6217002 · 6217002
1 parent 0edda2e
commit 6217002
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/lib/ravel.js b/lib/ravel.js
@@ -183,7 +183,7 @@ class Ravel extends EventEmitter {
       store: redisStore(sessionStoreArgs),
       cookie: {
         path: '/',
-        httpOnly: false,
+        httpOnly: true,
         maxage: null,
         rewrite: true,
         signed: true

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ravel",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "author": "Sean McIntyre <[email protected]>",
   "description": "Ravel Rapid Application Development Framework",
   "keywords": [