secure connexion in session cookie if https close #126

the cookie secure setting is set according to the secure param in the Config Which is defined at install time, default to true.
vincent-peugnet · Jan 3, 2024 · 002ee0c · 002ee0c
1 parent b785b88
commit 002ee0c
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/app/class/Config.php b/app/class/Config.php
@@ -163,7 +163,7 @@ public static function domain()
         return self::$domain;
     }
 
-    public static function issecure()
+    public static function issecure(): bool
     {
         return self::$secure;
     }

diff --git a/index.php b/index.php
@@ -13,7 +13,8 @@
 
 session_set_cookie_params([
     'path' => '/' . Wcms\Config::basepath(),
-    'samesite' => 'Strict'
+    'samesite' => 'Strict',
+    'secure' => Wcms\Config::issecure()
 ]);
 session_start();