Support Secure and HttpOnly flags in session cookie

[wojtekolesinski]

Is this a bug report or feature request?

• Feature Request

What should the feature do:

Allow the user to add the Secure and HttpOnly flags to session cookie. It can be configured the same way, as the SameSite attribute.

What is use case behind this feature:

These attributes allow developers to further secure the cookies. See mozilla docs below:
Restrict access to cookies
Cookie security

Additional Information:

[edwardzjl]

Currently the logout endpoint requires authservice_session been carried in the Header. (I don't know why)

To enable HttpOnly we need to change the logout endpoint first.

[wojtekolesinski]

Is there any reason we are using SessionFromID instead of SessionFromRequest in the logout function? I see, that the second method uses the first one under the hood, so maybe it could be a drop in replacement