[Android] Remote Access: harden session cookie flags

[Duncan McNamara]

vlc-android | branch: master | Duncan McNamara <dcn.mcnamara at gmail.com> | Tue Aug 18 10:51:00 2026 +0200| [8bdc27868137620d42581c23f9c114aab77d9109] | committer: Nicolas Pomepuy

Remote Access: harden session cookie flags

Add Secure, HttpOnly, and SameSite=Strict to the user_session
cookie. Closes a CSRF gap on GET routes like /favorite, /resume.

> https://code.videolan.org/videolan/vlc-android/commit/8bdc27868137620d42581c23f9c114aab77d9109
---

 .../java/org/videolan/vlc/remoteaccessserver/RemoteAccessServer.kt     | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/RemoteAccessServer.kt b/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/RemoteAccessServer.kt
index 0ad259237a..99046b801b 100644
--- a/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/RemoteAccessServer.kt
+++ b/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/RemoteAccessServer.kt
@@ -568,6 +568,9 @@ class RemoteAccessServer(private val context: Context) : PlaybackService.Callbac
 
                     cookie<UserSession>("user_session", directorySessionStorage(File("${context.filesDir.path}/server/cache"), true)) {
                         cookie.maxAgeInSeconds = RemoteAccessSession.maxAge
+                        cookie.secure = true
+                        cookie.httpOnly = true
+                        cookie.extensions["SameSite"] = "Strict"
                         transform(SessionTransportTransformerEncrypt(hex(encryptKey), hex(signkey)))
                     }
                 }