Adds httpOnly flag

1 files changed, 14 insertions, 9 deletions

diff --git a/example/index.ts b/example/index.ts
index e990e8a..9e2d9ef 100644
--- a/example/index.ts
+++ b/example/index.ts
@@ -54,15 +54,20 @@ const {
 
 app.use(express.static('./public/'));
 app.use(express.json());
-app.use( session( {
-  secret: 'secret123',
-  saveUninitialized: true,
-  resave: false,
-  cookie: { maxAge: 86400000 },
-  store: new MemoryStore( {
-    checkPeriod: 86_400_000 // prune expired entries every 24h
-  } ),
-} ) );
+app.use(
+  session({
+    secret: 'secret123',
+    saveUninitialized: true,
+    resave: false,
+    cookie: {
+      maxAge: 86400000,
+      httpOnly: true, // Ensure to not expose session cookies to clientside scripts
+    },
+    store: new MemoryStore({
+      checkPeriod: 86_400_000, // prune expired entries every 24h
+    }),
+  }),
+);
 
 /**
  * If the words "metadata statements" mean anything to you, you'll want to enable this route. It