From 897aa0d227768ff51e42c073275d757d549b7b2f Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Tue, 28 Apr 2026 18:56:11 +0100 Subject: [PATCH] Set secure and httponly attributes for TOTP cookie Reported-by: Jorge Gonzalez Milla --- app/controllers/application_controller.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index a5a10c0b8..c096bbb74 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -283,7 +283,9 @@ class ApplicationController < ActionController::Base cookies["_osm_totp_token"] = { :value => ROTP::TOTP.new(Settings.totp_key, :interval => 3600).now, :domain => Settings.totp_domain, - :expires => 1.hour.from_now + :expires => 1.hour.from_now, + :secure => Settings.server_protocol == "https", + :httponly => true } end end -- 2.47.3