7.0.0
This release renames the default session cookie to add a __Secure-
prefix, which, in compliant user agents, means that the cookie will be rejected when used in insecure contexts (such as HTTPS to HTTP downgrade).
This change is a major BC break, since upgrading the library will now lead to active sessions being dropped when deploying an application with this new version.
References:
- https://scotthelme.co.uk/tough-cookies/
- https://tools.ietf.org/html/draft-ietf-httpbis-cookie-prefixes-00
Total issues resolved: 3