@@ -184,14 +184,27 @@ func (p *OauthProxy) SetCookie(rw http.ResponseWriter, req *http.Request, val st
184184 if *cookieDomain != "" && strings.HasSuffix(domain, *cookieDomain) {
185185 domain = *cookieDomain
186186 }
187+ need_expire := true
188+ expire := time.Now().Add(time.Duration(*cookieExpire))
189+ if *cookieExpire == 0 {
190+ need_expire = false
191+ }
192+ http_only := true
193+ secure := false
194+ if *cookieSecure {
195+ http_only = false
196+ secure = true
197+ }
187198 cookie := &http.Cookie{
188199 Name: p.CookieKey,
189200 Value: signedCookieValue(p.CookieSeed, p.CookieKey, val),
190201 Path: "/",
191202 Domain: domain,
192− Expires: time.Now().Add(time.Duration(168) * time.Hour), // 7 days
193− HttpOnly: true,
194− // Secure: req. ... ? set if X-Scheme: https ?
203+ HttpOnly: http_only,
204+ Secure: secure,
205+ }
206+ if need_expire {
207+ cookie.Expires = expire
195208 }
196209 http.SetCookie(rw, cookie)
197210}