Set session/CSRF cookies with secure flag.

Part of #32.
SpongePowered · Jul 29, 2017 · 981ef5b · 981ef5b
1 parent 3d852ad
commit 981ef5b
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/spongeauth/spongeauth/settings/prod.py b/spongeauth/spongeauth/settings/prod.py
@@ -14,6 +14,11 @@
 DEFAULT_FROM_EMAIL = '[email protected]'
 SERVER_EMAIL = '[email protected]'
 
+SESSION_COOKIE_SECURE = True
+SESSION_COOKIE_HTTPONLY = True
+CSRF_COOKIE_SECURE = True
+CSRF_COOKIE_HTTPONLY = True
+
 EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
 EMAIL_USE_TLS = True
 EMAIL_USE_SSL = False