fix(cookies): add Secure flag to all Set-Cookie headers

Algorithm5838 · Algorithm5838 · commit f6bc9136975c · 2026-04-26T23:47:40.000+03:00
diff --git a/src/server.rs b/src/server.rs
@@ -275,7 +275,7 @@ impl ResponseExt for Response<Body> {
 	}
 
 	fn remove_cookie(&mut self, name: String) {
-		let removal_cookie = Cookie::build(name).path("/").http_only(true).expires(OffsetDateTime::now_utc());
+		let removal_cookie = Cookie::build(name).path("/").http_only(true).secure(true).expires(OffsetDateTime::now_utc());
 		if let Ok(val) = header::HeaderValue::from_str(&removal_cookie.to_string()) {
 			self.headers_mut().append("Set-Cookie", val);
 		}
diff --git a/src/settings.rs b/src/settings.rs
@@ -84,6 +84,7 @@ pub async fn set(req: Request<Body>) -> Result<Response<Body>, String> {
 				Cookie::build((name.to_owned(), value.clone()))
 					.path("/")
 					.http_only(true)
+					.secure(true)
 					.expires(OffsetDateTime::now_utc() + Duration::weeks(52))
 					.into(),
 			),
@@ -126,6 +127,7 @@ fn set_cookies_method(req: Request<Body>, remove_cookies: bool) -> Response<Body
 				Cookie::build((name.to_owned(), value.clone()))
 					.path("/")
 					.http_only(true)
+					.secure(true)
 					.expires(OffsetDateTime::now_utc() + Duration::weeks(52))
 					.into(),
 			),
@@ -167,6 +169,7 @@ fn set_cookies_method(req: Request<Body>, remove_cookies: bool) -> Response<Body
 				Cookie::build((subscriptions_cookie, list))
 					.path("/")
 					.http_only(true)
+					.secure(true)
 					.expires(OffsetDateTime::now_utc() + Duration::weeks(52))
 					.into(),
 			);
@@ -218,6 +221,7 @@ fn set_cookies_method(req: Request<Body>, remove_cookies: bool) -> Response<Body
 				Cookie::build((filters_cookie, list))
 					.path("/")
 					.http_only(true)
+					.secure(true)
 					.expires(OffsetDateTime::now_utc() + Duration::weeks(52))
 					.into(),
 			);
diff --git a/src/subreddit.rs b/src/subreddit.rs
@@ -220,6 +220,7 @@ pub async fn add_quarantine_exception(req: Request<Body>) -> Result<Response<Bod
 		Cookie::build((&format!("allow_quaran_{}", subreddit.to_lowercase()), "true"))
 			.path("/")
 			.http_only(true)
+			.secure(true)
 			.expires(cookie::Expiration::Session)
 			.into(),
 	);
@@ -390,6 +391,7 @@ pub async fn subscriptions_filters(req: Request<Body>) -> Result<Response<Body>,
 				Cookie::build((subscriptions_cookie, list))
 					.path("/")
 					.http_only(true)
+					.secure(true)
 					.expires(OffsetDateTime::now_utc() + Duration::weeks(52))
 					.into(),
 			);
@@ -438,6 +440,7 @@ pub async fn subscriptions_filters(req: Request<Body>) -> Result<Response<Body>,
 				Cookie::build((filters_cookie, list))
 					.path("/")
 					.http_only(true)
+					.secure(true)
 					.expires(OffsetDateTime::now_utc() + Duration::weeks(52))
 					.into(),
 			);

Original file line number	Diff line number	Diff line change
`@@ -275,7 +275,7 @@ impl ResponseExt for Response<Body> {`
`275`	`275`	`}`
`276`	`276`
`277`	`277`	`fn remove_cookie(&mut self, name: String) {`
`278`		`- let removal_cookie = Cookie::build(name).path("/").http_only(true).expires(OffsetDateTime::now_utc());`
	`278`	`+ let removal_cookie = Cookie::build(name).path("/").http_only(true).secure(true).expires(OffsetDateTime::now_utc());`
`279`	`279`	`if let Ok(val) = header::HeaderValue::from_str(&removal_cookie.to_string()) {`
`280`	`280`	`self.headers_mut().append("Set-Cookie", val);`
`281`	`281`	`}`