naiba 78f5b014ee fix(csrf): set Secure on csrf cookie only over HTTPS ...

CodeQL go/cookie-secure-not-set (CWE-614) flagged the nz-csrf cookie as
missing the Secure attribute. Mirror writeOauth2StateCookie and derive
Secure from the request scheme instead of hardcoding it: forcing
Secure=true would make browsers drop the cookie on plain-HTTP intranet
deployments, breaking the double-submit CSRF pair and 403-ing every
unsafe request.

2026-06-05 01:08:00 +00:00

..

dashboard

fix(csrf): set Secure on csrf cookie only over HTTPS

2026-06-05 01:08:00 +00:00