Merge pull request #13 from nordnet/httpOnly-toggle

Http only toggle
stape-io · Dec 12, 2024 · aec467b · aec467b
2 parents f4d40e4 + 3033549
commit aec467b
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/template.js b/template.js
@@ -387,7 +387,7 @@ function storeClientId(eventModel) {
       samesite: getCookieType(eventModel),
       secure: true,
       'max-age': 63072000, // 2 years
-      httpOnly: false,
+      httpOnly: data.httpOnlyCookie || false,
     });
   }
 }
@@ -632,4 +632,4 @@ function parseUrlEncoded(data) {
   }
 
   return parsedData;
-}
+}
diff --git a/template.tpl b/template.tpl
@@ -36,6 +36,14 @@ ___TEMPLATE_PARAMETERS___
     "simpleValueType": true,
     "help": "If enabled, the server only accessible FPID cookie, generated by UA/GA4 client, will be duplicated to FPIDP cookie, which will be accessible from the client JS. Highly recommend using this option only in case it is necessary."
   },
+  {
+    "type": "CHECKBOX",
+    "name": "httpOnlyCookie",
+    "checkboxText": "Write the _dcid cookie as HttpOnly",
+    "simpleValueType": true,
+    "help": "If enabled, the _dcid cookie will be written with the HttpOnly flag, making it non-accsessible by javascript.",
+    "defaultValue": false
+  },
   {
     "type": "CHECKBOX",
     "name": "generateClientId",
@@ -663,7 +671,7 @@ function storeClientId(eventModel) {
       samesite: getCookieType(eventModel),
       secure: true,
       'max-age': 63072000, // 2 years
-      httpOnly: false,
+      httpOnly: data.httpOnlyCookie || false
     });
   }
 }