Commit 92490c32 authored by Sean McGivern's avatar Sean McGivern

Merge branch 'sh-set-httponly-experimentation-subject-id' into 'master'

Enable the HttpOnly flag for experimentation_subject_id cookie

Closes #34851

See merge request gitlab-org/gitlab!19189
parents 87332f2d b61cc5dd
---
title: Enable the HttpOnly flag for experimentation_subject_id cookie
merge_request: 19189
author:
type: security
......@@ -38,7 +38,8 @@ module Gitlab
cookies.permanent.signed[:experimentation_subject_id] = {
value: SecureRandom.uuid,
domain: :all,
secure: ::Gitlab.config.gitlab.https
secure: ::Gitlab.config.gitlab.https,
httponly: true
}
end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment