[5.2] Session now respects the http_only config option

[ddmills]

The config('session.http_only') option is not respected by the StartSession middleware. This option is useful for setting authentication cookies when running Behat tests with selenium2 and chrome driver.

In the session config file, it describes this option but never uses it:

   /*
    |--------------------------------------------------------------------------
    | HTTP Access Only
    |--------------------------------------------------------------------------
    |
    | Setting this value to true will prevent JavaScript from accessing the
    | value of the cookie and the cookie will only be accessible through
    | the HTTP protocol. You are free to modify this option if needed.
    |
    */

    'http_only' => true,

[vlakoff]

Indeed, the change has had been made to laravel/laravel (laravel/laravel#3697), but the corresponding change in laravel/framework had been overlooked (#12809). Good catch :)

[mzaalan]

:)