Merge pull request #13 from Crowdhandler/maintenance/soften-cookie-flags-to-enable-backup-cookie-via-js

HttpOnly flag removed from cookie set. We are doing this as a risk vs…

Author: luke-owen-crowdhandler

dist/worker.js

@@ -351,7 +351,7 @@ async function handleRequest(event) {
   //If this is a freshly promoted session, strip the special CrowdHandler parameters by issuing a redirect.
   if (freshlyPromoted) {
     let setCookie = {
-      'Set-Cookie': `crowdhandler=${token}; path=/; Secure; HttpOnly`,
+      'Set-Cookie': `crowdhandler=${token}; path=/; Secure`,
     }
     let redirectLocation
     if (queryString) {
@@ -471,7 +471,7 @@ async function handleRequest(event) {
           status: 302,
           headers: Object.assign(helpers.noCacheHeaders, {
             Location: redirectLocation,
-            'Set-Cookie': `crowdhandler=${responseBody.token}; path=/; Secure; HttpOnly`,
+            'Set-Cookie': `crowdhandler=${responseBody.token}; path=/; Secure`,
           }),
         })
       } else {
@@ -509,7 +509,7 @@ async function handleRequest(event) {
   if (validToken.test(responseBody.token) === true) {
     modifiedOriginResponse.headers.append(
       'set-cookie',
-      `crowdhandler=${responseBody.token}; path=/; Secure; HttpOnly`,
+      `crowdhandler=${responseBody.token}; path=/; Secure`,
     )
   }
   //Set integration method cookie