From 35016a170a554dbf407eb05b6bfde912874a27ae Mon Sep 17 00:00:00 2001
From: Ed Clements <edward.clements@futurelearn.com>
Date: Mon, 7 Sep 2026 15:14:08 +0100
Subject: [PATCH] Add cookieSecure and cookieSameSite config options

---
 README.md      | 2 ++
 src/cookies.js | 8 ++++++--
 src/index.js   | 6 ++++--
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index fc10b2ed..b51a40b4 100644
--- a/README.md
+++ b/README.md
@@ -185,6 +185,8 @@ ahoy.configure({
   trackVisits: true,
   cookies: true,
   cookieDomain: null,
+  cookieSecure: false,
+  cookieSameSite: "lax",
   headers: {},
   visitParams: {},
   withCredentials: false,
diff --git a/src/cookies.js b/src/cookies.js
index a40589a8..2fc225a5 100644
--- a/src/cookies.js
+++ b/src/cookies.js
@@ -1,9 +1,10 @@
 // https://www.quirksmode.org/js/cookies.html
 
 export default {
-  set: function (name, value, ttl, domain) {
+  set: function (name, value, ttl, domain, secure, sameSite) {
     let expires = "";
     let cookieDomain = "";
+    let cookieSecure = "";
     if (ttl) {
       const date = new Date();
       date.setTime(date.getTime() + (ttl * 60 * 1000));
@@ -12,7 +13,10 @@ export default {
     if (domain) {
       cookieDomain = "; domain=" + domain;
     }
-    document.cookie = name + "=" + escape(value) + expires + cookieDomain + "; path=/; samesite=lax";
+    if (secure) {
+      cookieSecure = "; secure";
+    }
+    document.cookie = name + "=" + escape(value) + expires + cookieDomain + "; path=/; samesite=" + (sameSite || "lax") + cookieSecure;
   },
   get: function (name) {
     let i, c;
diff --git a/src/index.js b/src/index.js
index fda15047..401697f2 100644
--- a/src/index.js
+++ b/src/index.js
@@ -11,6 +11,8 @@ const config = {
   trackVisits: true,
   cookies: true,
   cookieDomain: null,
+  cookieSecure: false,
+  cookieSameSite: "lax",
   headers: {},
   visitParams: {},
   withCredentials: false,
@@ -67,7 +69,7 @@ function serialize(object) {
 // cookies
 
 function setCookie(name, value, ttl) {
-  Cookies.set(name, value, ttl, config.cookieDomain || config.domain);
+  Cookies.set(name, value, ttl, config.cookieDomain || config.domain, config.cookieSecure, config.cookieSameSite);
 }
 
 function getCookie(name) {
@@ -75,7 +77,7 @@ function getCookie(name) {
 }
 
 function destroyCookie(name) {
-  Cookies.set(name, "", -1, config.cookieDomain || config.domain);
+  Cookies.set(name, "", -1, config.cookieDomain || config.domain, config.cookieSecure, config.cookieSameSite);
 }
 
 function log(message) {