Merge 83b9fd3 into 1ad3f8d

.travis.yml

@@ -1,15 +1,12 @@
 language: node_js
 node_js:
-  - 0.10
-  - 0.12
-  - iojs
-
-cache:
-  directories:
-    - node_modules
+  - 8
+  - 10
+  - 12
 
-before_install:
-  - npm install --upgrade npm -g
+matrix:
+  allow_failures:
+  - node_js: 12
 
 script:
   - npm run cover-test
@@ -19,4 +16,4 @@ notifications:
     urls:
       - https://webhooks.gitter.im/e/7937aa9d2e9d767d0421
     on_success: always
-    on_failure: always
+    on_failure: always

lib/cli/generate.js

@@ -179,8 +179,6 @@ exports.generate = function(program) {
     /* Generate package.json */
     packagejs = '{\n  "name": "' + name + '",\n  "description": "An awesome real time application",\n  "version": "0.0.1",\n'+
                 '  "author": "Me <me@mydomain.com>",\n  "private": true,\n  "engines": { "node": ">= 0.10.0" },\n  "dependencies": {';
-    packagejs += '\n    "normalize.css": "3.0.x",';
-    packagejs += '\n    "es6-shim": "0.33.x",';
     packagejs += '\n    "socketstream": "0.4.x"';
     mods = selectedFormatters.concat(['hogan']);
     if (program.repl) {

lib/http/index.js

@@ -181,7 +181,13 @@ module.exports = function(root) {
       if (settings.strategy.session) {
         var cookie = {
           path: '/',
-          httpOnly: false,
+          // prevents third-party scripts such as Google Analytics
+          // and XSS attackers from stealing cookies and gaining access
+          // to paywalled or otherwise login-protected or private resources
+          // see https://blog.codinghorror.com/protecting-your-cookies-httponly/
+          // It was set to false pre-0.4.6 to support sessions over
+          // flash transport of socket.io
+          httpOnly: true,
           maxAge: sessionOptions.maxAge,
           secure: settings.secure
         };

lib/socketstream.js

@@ -207,7 +207,9 @@ function unload() {
   client.unload();
   client.assets.unload();
   http.unload();
-  if (api.server) api.server.responders = undefined;
+  if (api.server) {
+    api.server.responders = undefined;
+  }
   ws.unload();
 }