set httponly on cookies

2025-10-15 05:53:00 +00:00 · 2017-07-11 11:06:00 +02:00
parent 396f454998
commit a51141810d
2 changed files with 5 additions and 3 deletions
--- a/jupyterhub/services/auth.py
+++ b/jupyterhub/services/auth.py
@@ -478,6 +478,7 @@ class HubOAuth(HubAuth):
        """Set a cookie recording OAuth result"""
        kwargs = {
            'path': self.base_url,
+            'httponly': True,
        }
        if handler.request.protocol == 'https':
            kwargs['secure'] = True