From 9660149c67b5737dae4221fbfdc5f2252ce3aee9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <fromme@dreipunktnull.com>
Date: Fri, 10 Jul 2026 14:30:31 +0200
Subject: [PATCH] fix: prevent stale htmx cache on login potentially causing
 csrf issues

addresses #869dd1fch
---
 config/packages/framework.yaml                  | 5 ++---
 templates/booking/create/authenticate.html.twig | 2 +-
 templates/security/login.html.twig              | 2 +-
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/config/packages/framework.yaml b/config/packages/framework.yaml
index 6e7cd0b..9293aca 100644
--- a/config/packages/framework.yaml
+++ b/config/packages/framework.yaml
@@ -9,9 +9,8 @@ framework:
     # Remove or comment this section to explicitly disable session support.
     session:
         handler_id: null
-        cookie_secure: auto
-        # cookie_samesite: lax
-        cookie_samesite: none # this is to make login work in staging environment. to be removed when going live!
+        cookie_secure: true
+        cookie_samesite: lax
 
     #esi: true
     #fragments: true
diff --git a/templates/booking/create/authenticate.html.twig b/templates/booking/create/authenticate.html.twig
index 072a91b..e4dfd66 100644
--- a/templates/booking/create/authenticate.html.twig
+++ b/templates/booking/create/authenticate.html.twig
@@ -45,7 +45,7 @@
                     {% include '_partials/_alert.html.twig' with { 'level': 'error', messages: [ error.messageKey|trans(error.messageData, 'security') ] } %}
                 {% endif %}
 
-                <form action="{{ path('app_login') }}" method="post">
+                <form action="{{ path('app_login') }}" method="post" hx-history="false">
                     <div class="mb-4">
                         <label for="username" class="mb-1 font-semibold text-white">
                             E-Mail:
diff --git a/templates/security/login.html.twig b/templates/security/login.html.twig
index afe862a..50f86a4 100644
--- a/templates/security/login.html.twig
+++ b/templates/security/login.html.twig
@@ -11,7 +11,7 @@
                 {% include '_partials/_alert.html.twig' with { 'level': 'error', messages: [ error.messageKey|trans(error.messageData, 'security') ] } %}
             {% endif %}
             <div class="pb-4">
-                <form action="{{ path('app_login') }}" method="post">
+                <form action="{{ path('app_login') }}" method="post" hx-history="false">
                     <div class="mb-4">
                         <label for="username" class="mb-1 font-semibold text-white">
                             E-Mail: