I suggest to add httponly: true in template of devise.rb

[kossy0701]

Summary

Thanks you make amazing Gem. and all contributers.

I think add httponly: true in template of devise.rb.

A cookie with the HttpOnly attribute is inaccessible to the JavaScript Document.cookie API; it's only sent to the server. For example, cookies that persist in server-side sessions don't need to be available to JavaScript and should have the HttpOnly attribute. This precaution helps mitigate cross-site scripting (XSS) attacks.

Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies

Fix Proposal

   # secure: true in order to force SSL only cookies.
+  # httponly: true in order to restrict operate with JavaScript.

https://github.com/heartcombo/devise/blob/main/lib/generators/templates/devise.rb#L176