From e7821f655b7bcd57ff7ecb5250b427ed01c9790f Mon Sep 17 00:00:00 2001
From: Zaid Abdulla <zaid@genieacs.com>
Date: Thu, 16 May 2019 01:47:37 -0700
Subject: [PATCH] Mitigate CSRF using samesite for session cookie

---
 lib/ui.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/ui.ts b/lib/ui.ts
index 3d7df6a..ca26fb8 100644
--- a/lib/ui.ts
+++ b/lib/ui.ts
@@ -82,7 +82,7 @@ router.post("/login", async ctx => {
   function success(roles, method): void {
     log.method = method;
     const token = jwt.sign({ username, roles }, JWT_SECRET);
-    ctx.cookies.set(JWT_COOKIE, token);
+    ctx.cookies.set(JWT_COOKIE, token, { sameSite: "lax" });
     ctx.body = JSON.stringify(token);
     logger.accessInfo(log);
   }