From 87373eaff255f52ce2583d9cd91e00e59b038c2e Mon Sep 17 00:00:00 2001
From: yflory <yann.flory@xwiki.com>
Date: Tue, 21 Apr 2026 16:23:05 +0200
Subject: [PATCH] fix(sso): update saml cookie settings

---
 lib/http-worker.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/http-worker.js b/lib/http-worker.js
index b99c2243f..03dac79c7 100644
--- a/lib/http-worker.js
+++ b/lib/http-worker.js
@@ -258,7 +258,7 @@ app.use('/ssoauth', (req, res, next) => {
                 Log.error('E_SSO_WRITE_REQ', err);
                 return res.sendStatus(500);
             }
-            let value = `samltoken="${token}"; SameSite=Strict; HttpOnly`;
+            let value = `samltoken="${token}"; SameSite=Strict; HttpOnly; Path=/; Secure`;
             res.setHeader('Set-Cookie', value);
             next();
         });