session-middleware@0.4.0
Breaking Changes📦 remixView on GitHub →
⚠ 1 breaking🔧 2 symbols
Summary
This release introduces a breaking change to session cookie handling, defaulting them to HttpOnly for enhanced security. It also includes dependency updates for `@remix-run/*` packages.
⚠️ Breaking Changes
- Session cookies now default to HttpOnly when the cookie's httpOnly option is omitted. To preserve access from client-side JavaScript, set httpOnly: false explicitly. The middleware will emit a warning when this protection is disabled.
Migration Steps
- If client-side JavaScript needs to access session cookies, explicitly set `httpOnly: false` when creating the cookie.