tree bd9f0f4bc67cdb5a2dbffe7500e9432331698df3
parent d10fe0d8fd614f6ae6606179b0326bdc6a5f6af8
author Florian Zschocke <florian.zschocke@devolo.de> 1481363865 +0100
committer Florian Zschocke <florian.zschocke@devolo.de> 1481363865 +0100

Set secure user cookies and only for HTTP.

Mark the user authentication cookie to be only used for HTTP, making
it inaccessible for JavaScript engines.


If only HTTPS is used and no HTTP (i.e. also if HTTP is redirected to
HTTPS) then mark the user cookie to be sent only over secure connections.