Skip to content

Conversation

@desimone
Copy link
Collaborator

Summary

Changes

  • Expanded the Cookie HTTP Only section to document XSS vulnerabilities
  • Added clear explanations of security risks including client-side attacks and third-party script access
  • Included a security warning box with actionable guidance for securing applications when HttpOnly is disabled

Fixes #1877

desimone added 2 commits June 27, 2025 14:28
This adds a llms.txt file to the root of the documentation repository.
This file explicitly grants permission for Large Language Models (LLMs)
to ingest and use Pomerium's public documentation.

Fixes #1862
Add comprehensive security warnings to the cookie_http_only documentation
to help users understand the risks of disabling HttpOnly cookies:

- Document XSS vulnerabilities when HttpOnly is disabled
- Add warnings about client-side attacks and third-party script risks
- Include security warning box with best practices
- Provide guidance for users who must disable HttpOnly

Fixes #1877
@desimone desimone requested a review from a team as a code owner June 27, 2025 21:55
@desimone desimone requested review from rjbeers and removed request for a team June 27, 2025 21:55
@netlify
Copy link

netlify bot commented Jun 27, 2025

Deploy Preview for pomerium-docs ready!

Name Link
🔨 Latest commit 9faa56b
🔍 Latest deploy log https://app.netlify.com/projects/pomerium-docs/deploys/685f16b84d787b000874fb8d
😎 Deploy Preview https://deploy-preview-1894--pomerium-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

- Fix admonition block formatting by adding required blank line after warning header
- Remove llms.txt file as requested
- Apply prettier formatting to ensure consistency
Copy link

@rjbeers rjbeers left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Something is still off with the warning

desimone and others added 2 commits June 27, 2025 15:06
- Remove trailing whitespace
- Remove extra blank line after admonition block
- Ensure consistent formatting throughout the file
@desimone desimone enabled auto-merge (squash) June 27, 2025 22:10
@desimone desimone requested a review from rjbeers June 27, 2025 22:19
Copy link

@rjbeers rjbeers left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good now!

@desimone desimone merged commit 463ea8f into main Jun 27, 2025
9 checks passed
@desimone desimone deleted the desimone/1877 branch June 27, 2025 22:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Expand cookie_http_only Docs to Acknowledge Risks of Disabling HttpOnly

3 participants