feat: set httpOnly based on DISABLE_HTTP_ONLY_COOKIE flag (#5448)

Co-authored-by: Pavel White <[email protected]>
open-condo-software · Nov 10, 2024 · 3059efc · 3059efc
1 parent 30b98c2
commit 3059efc
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/packages/keystone/setup.utils.js b/packages/keystone/setup.utils.js
@@ -70,6 +70,7 @@ function prepareDefaultKeystoneConfig (conf) {
             sameSite: HTTPS_REGEXP.test(conf.SERVER_URL) && conf.NODE_ENV === 'production' ? 'None' : 'Lax',
             // NOTE(pahaz): Apollo server client doesn't work with secure=true! Need to research why
             secure: HTTPS_REGEXP.test(conf.SERVER_URL) && conf.NODE_ENV === 'production',
+            httpOnly: conf.DISABLE_HTTP_ONLY_COOKIE !== 'true',
             // 1000 * (Math.pow(2, 31) - 1) IS APPROXIMATELY 68 YEARS IN MILLISECONDS :)
             maxAge: conf.COOKIE_MAX_AGE || 1000 * (Math.pow(2, 31) - 1),
         },