Scott Lamb 3c1163dfe2 use SameSite=Strict (for #26)
I initially chose SameSite=Lax because I thought if a user followed a
link to the landing page, the landing page's ajax requests wouldn't send
the cookie. But I just did an experiment, and that's not true. Only the
initial page load (of a .html file) lacks the cookie. All of its
resources and ajax requests send the cookie. I'm not sure about
document.cookie accesses, but my cookie is HttpOnly anyway, so it's
irrelevant. So no reason to be lax.
2018-12-01 22:04:54 -08:00
..
2018-12-01 15:20:19 -08:00
2018-12-01 22:04:54 -08:00
2018-12-01 15:27:54 -08:00
2018-12-01 15:20:19 -08:00
2018-12-01 15:27:54 -08:00
2018-03-07 04:42:46 -08:00
2018-11-27 11:08:33 -08:00
2018-12-01 15:20:19 -08:00
2018-08-24 22:06:14 -07:00