login: the session cookie Secure behind a TLS proxy

Review finding 12, browsers: the session cookie had no Secure flag.
Behind a TLS proxy, the token it carries went over plain HTTP if
someone typed http://.

POST /auth/session now sets Secure when the request came over TLS, as
the proxy says (X-Forwarded-Proto, or Forwarded's proto, of the first
hop). A client saying so itself only keeps its own cookie off plain
HTTP. operations.md's nginx example sets the header.

0 files changed, 0 insertions, 0 deletions