fix: omit Secure attribute from cookies when cookie_secure is false#730
Merged
fergusfinn merged 2 commits intomainfrom Feb 18, 2026
Merged
fix: omit Secure attribute from cookies when cookie_secure is false#730fergusfinn merged 2 commits intomainfrom
fergusfinn merged 2 commits intomainfrom
Conversation
The Set-Cookie header was emitting `Secure=false` when cookie_secure was disabled. Per the HTTP spec, the Secure attribute is a flag — any presence of it (including `Secure=false`) causes browsers to treat the cookie as secure-only, preventing it from being set over plain HTTP. This also fixes the logout cookie which hardcoded `Secure` regardless of the cookie_secure config setting.
railway-app
bot
temporarily deployed
to
industrious-light / control-layer-pr-730
|
🚅 Deployed to the control-layer-pr-730 environment in industrious-light
|
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request fixes a critical security misconfiguration in cookie handling. When cookie_secure is set to false, the code was incorrectly emitting Secure=false in the Set-Cookie header. Per the HTTP specification, the Secure attribute is a boolean flag, and any presence of it (even with =false) causes browsers to treat the cookie as secure-only, preventing it from being set over plain HTTP. The fix correctly omits the Secure attribute entirely when cookie_secure is false.
Changes:
- Modified
logouthandler to conditionally include theSecurecookie attribute based oncookie_secureconfiguration - Modified
create_session_cookiehelper function to conditionally include theSecureattribute, fixing bothloginandregisterhandlers
railway-app
bot
temporarily deployed
to
industrious-light / control-layer-pr-730
sejori
reviewed
Feb 18, 2026
| "{}=; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=0", | ||
| state.config.auth.native.session.cookie_name | ||
| "{}=; Path=/; HttpOnly{}; SameSite=Strict; Max-Age=0", | ||
| state.config.auth.native.session.cookie_name, secure |
Contributor
There was a problem hiding this comment.
I actually don't love rust templating that much but the result is good ;)
fergusfinn
pushed a commit
that referenced
this pull request
Feb 19, 2026
🤖 I have created a release *beep* *boop* --- ## [8.1.0](v8.0.1...v8.1.0) (2026-02-19) ### Features * make demo mode data more realistic ([#731](#731)) ([17aa9bf](17aa9bf)) ### Bug Fixes * advance to step 2 when manually configuring models in edit endpoint modal ([#728](#728)) ([fdcf360](fdcf360)) * omit Secure attribute from cookies when cookie_secure is false ([#730](#730)) ([e6f936e](e6f936e)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cookie_secureis set tofalse, theSet-Cookieheader was emittingSecure=false. Per the HTTP spec,Secureis a boolean flag — its mere presence causes browsers to treat the cookie as secure-only, regardless of value.Secure=falseis not valid syntax and browsers interpret it the same asSecure, preventing the cookie from being set over plain HTTP.; Secureregardless of thecookie_secureconfig setting.Test plan
cookie_secure: falseinconfig.yamlSet-Cookieresponse header does not containSecurecookie_secure: trueand verify; Secureis present