WSA cookie security

cziter15 · Jun 15, 2024 · 9a3f862 · 9a3f862
1 parent e2ad1bd
commit 9a3f862
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/src/ksf/comp/ksDevicePortal.cpp b/src/ksf/comp/ksDevicePortal.cpp
@@ -554,7 +554,12 @@ namespace ksf::comps
 			return;
 
 		if (webSocket)
-			webServer->sendHeader(PSTR("Set-Cookie"), PSTR("WSA=") + String(webSocket->getRequiredAuthToken()));
+		{
+			String cookie{PSTR("WSA=")};
+			cookie += webSocket->getRequiredAuthToken();
+			cookie += PSTR("; Path=/; HttpOnly; SameSite=Strict");
+			webServer->sendHeader(PSTR("Set-Cookie") , cookie);
+		}
 
 		const auto& fileMD5{FPSTR(DEVICE_FRONTEND_HTML_MD5)};
 		if (webServer->header(PROGMEM_IF_NONE_MATCH) == fileMD5)