CSRF token cookie could be improved

[reivilibre]

I was just looking at the code for the CSRF token cookie and suspect it could be improved.

matrix-authentication-service/crates/axum-utils/src/csrf.rs

Line 134 in 7c67630

impl CsrfExt for CookieJar {

• cookie name should start with __Host- to prevent, in modern browsers that support this, some classes of cookie fixation attacks.
• making it HTTP-only and 'Secure' seems good as defence in depth

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies

I think localhost is considered 'Secure' so this shouldn't affect local development much, but there is a minor possibility this would need to be configurable.

[matrixbot]

For your information, this issue has been copied over to the Element fork of matrix-authentication-service: element-hq/matrix-authentication-service#2877