From 3798a42dc971f7eb919dd195d187c737b1918f08 Mon Sep 17 00:00:00 2001
From: Asher <ash@coder.com>
Date: Wed, 4 Nov 2026 12:59:44 -0900
Subject: [PATCH] Set HttpOnly on cookies (#8110)

---
 src/node/http.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/node/http.ts b/src/node/http.ts
index 027df102c..4dab2356a 100644
--- a/src/node/http.ts
+++ b/src/node/http.ts
@@ -330,6 +330,7 @@ export const getCookieOptions = (req: express.Request): express.CookieOptions =>
     domain: getCookieDomain(url.host, req.args["proxy-domain"]),
     path: normalize(url.pathname) || "/",
     sameSite: "lax",
+    httpOnly: true,
   }
 }