Add secure and httponly options for cookies

[cpadlab]

I have added the option to configure Secure and HttpOnly flags for cookies, as this prevents potential cookie theft or unauthorized access via scripts.

I have been testing this implementation locally on a server, and it works perfectly. To use it, the user only has to update the security section in the configuration file.

---

Example change in conf/conf.json:

From this:

"security": {
    "xsrf_protection": "token"
}

To this:

"security": {
    "xsrf_protection": "header",
    "cookie_secure": true,
    "cookie_httponly": true
}

[bugy]

Hi @cpadlab thanks!
Do you see any reason to make it configurable?
Can we just set these parameters for everyone?

[cpadlab]

Hi @cpadlab thanks! Do you see any reason to make it configurable? Can we just set these parameters for everyone?

Hi, I wanted to make it configurable to avoid issues with users deploying it on HTTP servers

[bugy]

I see. I guess we can set "httponly" to true always
For secure attribute you are right. But I would still make the default option as true and users would need to opt in for unsecure cookies.

What do you think?

[cpadlab]

Hi @bugy , You're absolutely right, I've just pushed the new commits