feat: improve session security with HttpOnly and MaxAge options #46
Conversation
Add HttpOnly flag to prevent XSS attacks on session cookies and set MaxAge to 3600 seconds (1 hour) for better session management
There was a problem hiding this comment.
Pull Request Overview
This PR enhances session security by configuring cookie options to protect against XSS attacks and improve session lifecycle management.
- Adds HttpOnly flag to session cookies to prevent client-side JavaScript access
- Sets MaxAge to 3600 seconds (1 hour) for automatic session expiration
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| router.Use(ginzap.RecoveryWithZap(logger, true)) | ||
| store := cookie.NewStore(secret) | ||
| store.Options(sessions.Options{ | ||
| MaxAge: 3600, |
There was a problem hiding this comment.
The MaxAge value of 3600 seconds (1 hour) is hardcoded. Consider making this configurable through environment variables or configuration files to allow different timeout values across environments.
| MaxAge: 3600, | |
| // Make session MaxAge configurable via environment variable | |
| maxAge := 3600 | |
| if v := os.Getenv("SESSION_MAX_AGE"); v != "" { | |
| if parsed, err := strconv.Atoi(v); err == nil && parsed > 0 { | |
| maxAge = parsed | |
| } | |
| } | |
| store.Options(sessions.Options{ | |
| MaxAge: maxAge, |
| store := cookie.NewStore(secret) | ||
| store.Options(sessions.Options{ | ||
| MaxAge: 3600, | ||
| HttpOnly: true, |
There was a problem hiding this comment.
The session options are missing the Secure flag which should be set to true in production to ensure cookies are only transmitted over HTTPS connections.
| HttpOnly: true, | |
| store := cookie.NewStore(secret) | |
| secureCookie := parsedExternalURL.Scheme == "https" | |
| store.Options(sessions.Options{ | |
| MaxAge: 3600, | |
| HttpOnly: true, | |
| Secure: secureCookie, |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
Summary
Add security improvements to session cookies by configuring HttpOnly flag and MaxAge timeout to enhance protection against XSS attacks and improve session management.
Type of Change
Related Issues