From cc594dc3ccd3a4275cfc1079d5415de41cde64fd Mon Sep 17 00:00:00 2001
From: Aleksandr Razumov <ernado@go-faster.org>
Date: Wed, 3 Jun 2026 18:22:21 +0300
Subject: [PATCH] fix: add Secure and SameSite attributes to dev layer cookie

Resolves gosec G124 lint warning.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 dl/dl.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dl/dl.go b/dl/dl.go
index 6676b51..2c60ffe 100644
--- a/dl/dl.go
+++ b/dl/dl.go
@@ -95,6 +95,8 @@ func (c *Client) download(ctx context.Context, layer int, key string) ([]byte, e
 			Value: strconv.Itoa(layer),
 
 			HttpOnly: true,
+			Secure:   true,
+			SameSite: http.SameSiteStrictMode,
 		})
 	}