Audit changes.

hub/cookie.go

@@ -2,7 +2,6 @@ package hub
 
 import (
 	"net/http"
-	"time"
 )
 
 func (a *App) getCookie(r *http.Request, name string) string {
@@ -26,9 +25,12 @@ func (a *App) setCookie(w http.ResponseWriter, name, value string) {
 
 func (a *App) deleteCookie(w http.ResponseWriter, name string) {
 	http.SetCookie(w, &http.Cookie{
-		Name:    name,
-		Value:   "",
-		Path:    "/",
-		Expires: time.Unix(0, 0),
+		Name:     name,
+		Value:    "",
+		Path:     "/",
+		Secure:   !a.insecure,
+		SameSite: http.SameSiteStrictMode,
+		HttpOnly: true,
+		MaxAge:   -1, // delete now
 	})
 }