Provide an option to set Form based auth encrypted cookie as HttpOnly

[michalvavrik]

fixes: #27609

Provide convenient way to make the cookie that is used to store the persistent session HttpOnly.

[michalvavrik]

cc @sberyozkin

[sberyozkin]

Hi @michalvavrik Thanks for the PR, looks fine, but I wonder, should we even introduce a property and instead just set HttpOnly by default ? We do it in quarkus-oidc too, there's no reason to allow the client side scripts access this cookie, so just adding this attribute by default works IMHO

[michalvavrik]

@sberyozkin doesn't client need to access this cookie in order to make it expired (aka "delete it") as advised here for logout #27389 (comment) ? I can prepare reproduce to find out, but if you know this already, you can tell me :-)

[sberyozkin]

@michalvavrik I forgot about, good point. Right, so ideally the logout would be handled at the server, by deleting the same cookie, but with form based authentication I suppose we should support the client side removal of this cookie too