Cookies security Options in the new Session API

[thoven87]

I have been testing the new Session API, it's been nice so far. I do wonder if there should be options allowed to be passed in different environments context. Say, in production we would like to se a session cookie sameSite as strict to prevent XSS and CSRF attack.

I think this option should be available given that setting a session is mundane task.

[adam-fowler]

Good point

[adam-fowler]

#72

[adam-fowler]

Merged

[thoven87]

Merged

My computer should arrive either this weekend or early next week. I will test and report. I think the same site enum still needs updated to allow strict as an option and also allows one to set a cookie as both strict and secure.

[adam-fowler]

I think the same site enum still needs updated to allow strict as an option and also allows one to set a cookie as both strict and secure.

Just realised I messed up the enum (named strict, secure by mistake)