embedthis/http — pull request #2 by jchampio (2012-05-03 21:41:35+00:00)
Title: HttpOnly Cookie Modifications

This branch consists of two modifications.

The first patch is a fix to the behavior of httpSetCookie, which set an additional "secure" attribute instead of "httponly" when the HTTP_COOKIE_HTTP flag was specified.

The second patch is a little bit more complex. RFC 6265 is the "current" standard for the use of the Set-Cookie header, and it specifies that the HttpOnly and Secure attributes may be combined on a single cookie (this allows a server to simultaneously restrict Javascript access and force browsers to transmit only over SSL/TLS). The current httpSetCookie allowed the use of only one or the other, so I added logic that allows both.

The doxygen comment for httpSetCookie has been updated to describe the new behavior. If there's a step I need to complete to actually generate the Doxygen documentation, let me know and I'll push up another patch.