This topic was marked solved by its starter, on January 9th, 2016, 04:40 PM
Wedge already wants to do that (setting httponly) but it misses some true arguments on setcookie().
Httponly basically forbids the browser/js to access document.cookies which prevents bad exploitation of xss (otherwise the cookie could get stolen).
https://www.owasp.org/index.php/HttpOnly
https://github.com/C3realGuy/wedge/commit/71a066380d1301a82c95cc5144039edceca98c9e
Httponly basically forbids the browser/js to access document.cookies which prevents bad exploitation of xss (otherwise the cookie could get stolen).
https://www.owasp.org/index.php/HttpOnly
https://github.com/C3realGuy/wedge/commit/71a066380d1301a82c95cc5144039edceca98c9e
