Set HttpOnly flag on cookies

babybuddy · Sep 17, 2021 · c8d4894 · c8d4894
1 parent 0e6a5cb
commit c8d4894
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/babybuddy/settings/base.py b/babybuddy/settings/base.py
@@ -240,9 +240,11 @@
     SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
 
 # https://docs.djangoproject.com/en/3.2/topics/http/sessions/#settings
+SESSION_COOKIE_HTTPONLY = True
 SESSION_COOKIE_SECURE = True
 
 # https://docs.djangoproject.com/en/3.2/ref/csrf/#settings
+CSRF_COOKIE_HTTPONLY = True
 CSRF_COOKIE_SECURE = True
 
 # https://docs.djangoproject.com/en/3.2/topics/auth/passwords/