Enable HttpOnly session cookies by default - #1059

Open

vharseko wants to merge 5 commits into

OpenIdentityPlatform:masterfrom

vharseko:features/httponly

Commits on Sep 30, 2026

Enable HttpOnly session cookies by default
vharseko
committed
646208f
ci: adapt e2e auth checks to default HttpOnly session cookies
vharseko
committed
e6c9998
mcp-server: read the SSO token from the session cookie under HttpOnly
vharseko
committed
b6ebd2d
Address review round: HttpOnly-by-default consumers and test gaps
vharseko
committed
a00408e
sts: pin the Set-Cookie fallback against a real HttpURLConnection
vharseko
committed
406fa4b