SameSite-Attribut des Session-Cookies auf Strict setzen

diff --git a/SL/Form.pm b/SL/Form.pm
index 46c7f6e..fd79b96 100644 (file)
--- a/SL/Form.pm
+++ b/SL/Form.pm
@@ -389,6 +389,7 @@ sub create_http_response {
                                      '-path'    => $uri->path,
                                      '-expires' => '+' . $::auth->{session_timeout} . 'm',
                                      '-secure'  => $::request->is_https);
+      $session_cookie = "$session_cookie; SameSite=strict";
     }
   }