Contents
How to set the HttpOnly flag in PHP?
For session cookies managed by PHP, the flag is set either permanently in php.ini PHP manual on HttpOnly through the parameter: For application cookies last parameter in setcookie () sets HttpOnly flag 7: If code changes are infeasible, web application firewalls can be used to add HttpOnly to session cookies:
What is the HttpOnly flag in the Set Cookie header?
What is HttpOnly? According to the Microsoft Developer Network , HttpOnly is an additional flag included in a Set-Cookie HTTP response header. Using the HttpOnly flag when generating a cookie helps mitigate the risk of client side script accessing the protected cookie (if the browser supports it).
How to disable the HttpOnly session ID cookies?
To disable HttpOnly Session ID cookies, change the value of the useHttpOnly parameter to false. You must be a registered user to add a comment. If you’ve already registered, sign in. Otherwise, register and sign in. Still have a question?
How to use HTTP-only Cookies with CherryPy sessions?
Python Code (cherryPy): To use HTTP-Only cookies with Cherrypy sessions just add the following line in your configuration file: tools.sessions.httponly = True If you use SLL you can also make your cookies secure (encrypted) to avoid “manipulator-in-the-middle” cookies reading with: tools.sessions.secure = True
1 Answer 1. In the PHP configuration file (php.ini), look for session.cookie_httponly setting and set it to True. session_start (); $params = session_get_cookie_params (); setcookie (“PHPSESSID”, session_id (), 0, $params [“path”], $params [“domain”], false, // this is the secure flag you need to set.
If this cookie is set, the browser will never send the cookie if the connection is HTTP. This flag prevents cookie theft via man-in-the-middle attacks. Note that this flag can only be set during an HTTPS connection. If it is set during an HTTP connection, the browser ignores it.
How to set HttpOnly and secure on PHPSESSID Cookie?
I use Apache httpd over HTTPS, set session.cookie_httponly = 1 & session.cookie_secure = 1 works for me. Paste the code in the functions.php file. Using .htaccess for this purpose just slows down your application. I think its better to add this snippet in your main config file ( example config.php ) or main include file ( example global.php )
What makes the PHPSESSID Cookie have a Secure flag?
The final parameter, true, makes the cookie have a secure flag. When I checked the PHPSESSID cookie in Firefox, its ‘Send for’ property was set to ‘Encrypted connections only’ and its ‘Expires’ property was set to ‘At end of session’. A more elegant solution since PHP >=7.0