Re: Patch for secure and httponly cookies
[email protected] (Emmanuel Dreyfus) Sun, 12 Apr 2009 20:56:27 +0200
| Newsgroups | gmane.comp.web.quixote.user |
|---|---|
| Message-ID | <1iy2vae.1xbn74wwtf4q1M%[email protected]> |
Neil Schemenauer <[email protected]> wrote: > Is there any reason for having both SESSION_COOKIE_SECURE and > SESSION_COOKIE_HTTPONLY? Maybe SESSION_COOKIE_SECURE should > imply both. Well, leave the choice to the user? I guess you could find situations where one is desirable but not the other: if you don't rely on SSL for security, but on a VPN for instance, then session_cookie_secure is undesirable, but session_cookie_httponly can remain interesting. -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz [email protected]