[Security]Uchiwa 0.22.2: SecureFlag missing in AuthenticationToken and XSRF-Token cookie

[itsDaksha]

Expected Behavior

From security point of view, it is required that SecureFlag must be set in all sensitive cookies.

Current Behavior

Currently, there is no SecureFlag in AuthenticationToken and XSRF-Token cookie

Possible Solution

SecureFlag can be added in HTTP response to avoid any security vulnerability.

Reference: https://www.owasp.org/index.php/SecureFlag

[palourde]

Note: We should only set the Secure flag if the connection is encrypted over HTTPS. It should be relatively easy to do here.

[itsDaksha]

Any possibility of getting this fix in 0.22.x?