Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update PHP setcookie() calls to use secure and HTTP #75

Open
terrymun opened this issue May 21, 2018 · 0 comments
Open

Update PHP setcookie() calls to use secure and HTTP #75

terrymun opened this issue May 21, 2018 · 0 comments
Assignees
@terrymun

Comments

@terrymun
Copy link
Member

terrymun commented May 21, 2018 •
edited
Loading

Right now calls to setcookie() actually uses PHP default (i.e. false) for HTTPonly and secure flags. The secure flag should always be true, and the httponly flag should be true if we know that it is not accessed by JS.
@terrymun terrymun self-assigned this May 21, 2018
terrymun added a commit that referenced this issue May 21, 2018
@terrymun
Issue #75: auth_token should use secure cookie flag, but allow JS access
a97b239
terrymun added a commit that referenced this issue May 21, 2018
@terrymun
Issue #75: CSRF_token should use both httponly and secure flags
d15711e
terrymun added a commit that referenced this issue May 21, 2018
@terrymun
Merge pull request #76 from lotusbase/issue-75
285b710 
Issue #75: Update PHP setcookie() calls to use secure and HTTP
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@terrymun terrymun

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@terrymun