Patch for secure and httponly cookies
[email protected] (Emmanuel Dreyfus) Sat, 11 Apr 2009 22:32:10 +0200
| Newsgroups | gmane.comp.web.quixote.user |
|---|---|
| Message-ID | <1iy0qlm.1mjci1wze52yzM%[email protected]> |
Hello It seems that Quixote 2.6 has no support for enforcing the secure and httponly flags for session cookies. This is important, as there are some documented attacks for stealing session cookies that are supposed to be secured over SSL, if they do not have the two flags set. Here is a patch that adds two config options: session_cookie_secure and session_cookie_httponly: http://ftp.espci.fr/shadow/manu/securecookie.patch Any chance to get that committed? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz [email protected]