luci-base: add another magic security attribute to the sysauth cookie

Fixes: #3585
Signed-off-by: Jo-Philipp Wich <jo@mein.io>

diff --git a/modules/luci-base/luasrc/dispatcher.lua b/modules/luci-base/luasrc/dispatcher.lua
index 48e125e4ae5cda3a890e302d93502c6f555b5b39..32d34da012db296345dd956620d4b16c2a998a69 100644 (file)
--- a/modules/luci-base/luasrc/dispatcher.lua
+++ b/modules/luci-base/luasrc/dispatcher.lua
@@ -806,7 +806,7 @@ function dispatch(request)
                                return tpl.render("sysauth", { duser = "root", fuser = user })
                        end
 
-                       http.header("Set-Cookie", 'sysauth=%s; path=%s; HttpOnly%s' %{
+                       http.header("Set-Cookie", 'sysauth=%s; path=%s; SameSite=Strict; HttpOnly%s' %{
                                sid, build_url(), http.getenv("HTTPS") == "on" and "; secure" or ""
                        })