Improvements¶ ↑

• HttpOnly is now set by default on the remember cookie, so it is no longer accessible from Javascript. This is a more secure approach that makes applications using Rodauth’s remember feature less vulnerable in case they are subject to a separate XSS attack.

• When using the jwt feature, rodauth.clear_session now clears the JWT session even when the Roda sessions plugin was in use. In most cases, the jwt feature is not used with the Roda sessions plugin, but in cases where the same application serves as both an JSON API and as a HTML site, it is possible the two may be used together.

Backwards Compatibility¶ ↑

• As the default remember cookie :httponly setting is now set to true, applications using Rodauth that expected to be able to access the remember cookie from Javascript will no longer work by default. In these cases, you should now use remember_cookie_options and include a :httponly=>false option.