Merge pull request #20015 from influxdata/session-handler-samesite

fix(http): Add same site strict flag to session cookie
influxdata · Nov 13, 2020 · aa1cefa · aa1cefa
2 parents 4efb851 + f7c7665
commit aa1cefa
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/http/session_handler.go b/http/session_handler.go
@@ -176,9 +176,10 @@ func decodeCookieSession(ctx context.Context, r *http.Request) (string, error) {
 // SetCookieSession adds a cookie for the session to an http request
 func SetCookieSession(key string, r *http.Request) {
 	c := &http.Cookie{
-		Name:   cookieSessionName,
-		Value:  key,
-		Secure: true,
+		Name:     cookieSessionName,
+		Value:    key,
+		Secure:   true,
+		SameSite: http.SameSiteStrictMode,
 	}
 
 	r.AddCookie(c)