From 5f9dcd259a87e1dbc958f4111e366bb56fad91b7 Mon Sep 17 00:00:00 2001
From: Asher <ash@coder.com>
Date: Tue, 3 Nov 2026 12:02:32 -0900
Subject: [PATCH] Set HttpOnly on cookies

---
 src/node/http.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/node/http.ts b/src/node/http.ts
index 027df102cd9d..4dab2356a0e0 100644
--- a/src/node/http.ts
+++ b/src/node/http.ts
@@ -330,6 +330,7 @@ export const getCookieOptions = (req: express.Request): express.CookieOptions =>
     domain: getCookieDomain(url.host, req.args["proxy-domain"]),
     path: normalize(url.pathname) || "/",
     sameSite: "lax",
+    httpOnly: true,
   }
 }