Session cookie is missing the 'secure' flag about madek

[eins78]

See here:

• session cookie https://github.com/Madek/madek-auth/blob/e77cc41093f84291157068a58cb35c0a30448383/cljc-src/madek/auth/http/session.clj#L80
• also the anti-csrf cookie https://github.com/Madek/madek-auth/blob/e77cc41093f84291157068a58cb35c0a30448383/cljc-src/madek/auth/http/anti_csrf/main.clj#L45

The (now seemingly unused) session cookie from the Rails webapp could maybe also be removed https://github.com/Madek/madek-webapp/blob/b7c4a6dc6016bf11df24ef2ff9966c1d266d54ed/config/initializers/session_store.rb

If "insecure" cookies are still needs for development and testing, the previous mechanism was to set the env variable DISABLE_HTTPS_THIS_IS_A_BAD_IDEA to a non-empty value.

https://github.com/Madek/madek-datalayer/blob/a824575be83cf6845eb28a3d14dbb22030cec7a5/lib/madek/constants.rb#L89

[DrTom]

It seems possible to alter cookies via https://httpd.apache.org/docs/2.4/mod/mod_headers.html

e.g.

Header set Set-Cookie HttpOnly;Secure

[DrTom]

Works via Proxy:

set-cookie: madek-session=REPLACED;HttpOnly;Path=/;Secure