Set csrf and session cookies secure attribute to true

src/main/java/de/webalf/slotbot/configuration/authentication/website/OAuth2EndpointConfig.java

@@ -43,6 +43,7 @@ public class OAuth2EndpointConfig {
 	protected SecurityFilterChain oAuthUserFilterChain(HttpSecurity http) throws Exception {
 		// https://docs.spring.io/spring-security/reference/5.8/migration/servlet/exploits.html#_i_am_using_angularjs_or_another_javascript_framework
 		final CookieCsrfTokenRepository tokenRepository = CookieCsrfTokenRepository.withHttpOnlyFalse();
+		tokenRepository.setSecure(true);
 		tokenRepository.setCookiePath("/");
 		final XorCsrfTokenRequestAttributeHandler delegate = new XorCsrfTokenRequestAttributeHandler();
 		// set the name of the attribute the CsrfToken will be populated on

src/main/resources/application.properties

@@ -16,6 +16,7 @@ spring.jpa.hibernate.ddl-auto=update
 #Not secured
 server.port=8080
 server.servlet.context-path=/backend
+server.servlet.session.cookie.secure=true
 
 server.cors.allowedOrigins=http://localhost:3000,http://slotbot-test1.amb:3000,http://slotbot-test2.amb:3000