[GH-ISSUE #539] [FEATURE] Considering to use much secure session cookie. #348

New issue

Closed

opened 2026-02-25 20:35:30 +03:00 by kerem · 1 comment

kerem commented

2026-02-25 20:35:30 +03:00

Owner

Originally created by @nakoo on GitHub (Nov 19, 2021).
Original GitHub issue: https://github.com/benbusby/whoogle-search/issues/539

Describe the feature you'd like to see added
Whoogle should only use session cookie when HTTPS is enforced so that we can improve the security by adding __host (OR __secure) prefix and Secure flag. Current set-cookie header is not secure option.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie

(screenshots from Mozilla Observatory)

Additional context
Since Whoogle now use much better implemetation of disabled cookie situation (#480), now we can enforce HTTPS to use session cookie. I think it's good time to do so.

Originally created by @nakoo on GitHub (Nov 19, 2021). Original GitHub issue: https://github.com/benbusby/whoogle-search/issues/539  **Describe the feature you'd like to see added** Whoogle should only use session cookie when HTTPS is enforced so that we can improve the security by adding `__host` (OR `__secure`) prefix and `Secure` flag. Current set-cookie header is not secure option. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie ![mo1](https://user-images.githubusercontent.com/4975021/142615672-7f0d29ae-f294-4794-9564-76321226be9d.png) ![mo2](https://user-images.githubusercontent.com/4975021/142615692-36d81785-7c33-4910-b47c-6f140a3caadc.png) (screenshots from Mozilla Observatory) **Additional context** Since Whoogle now use much better implemetation of disabled cookie situation (#480), now we can enforce HTTPS to use session cookie. I think it's good time to do so.

kerem

2026-02-25 20:35:30 +03:00

closed this issue
added the
enhancement
label

kerem commented

2026-02-25 20:35:31 +03:00

Author

Owner

@benbusby commented on GitHub (Nov 20, 2021):

Added -- these values are only set when the HTTPS_ONLY var is set though. Otherwise instances running in local networks w/o SSL wouldn't be able to use sessions anymore.

Thanks for the suggestion!

@benbusby commented on GitHub (Nov 20, 2021): Added -- these values are only set when the `HTTPS_ONLY` var is set though. Otherwise instances running in local networks w/o SSL wouldn't be able to use sessions anymore. Thanks for the suggestion!

kerem referenced this issue

2026-02-25 20:36:55 +03:00

[PR #360] [MERGED] Add lingva translation support in search #857