Extend form auth cookie configuration

[dector]

Description

Suggested configurations:

• Make cookie HttpOnly / add configuration option to force this.

  • Why? Current cookie is not HttpOnly which is not a safe way of using session cookie.
  • Workaround? Can you advice any? Is it possible intercept single endpoint response and modify it's cookies?

• or Add ability to modify session cookie after it was created by injecting some mapper function and calling it on the cookie instance (e.g. I would love to use Secure as my application server is running behind the reverse proxy (Caddy <---http--> Quarkus)).

Implementation ideas

No response

[michalvavrik]

I'll have a look provided no-one is working on this (?). Any preferences/requirements on impl. @sberyozkin ?