During a recent security sweep of our site, it was requested that we set our session cookies to be flagged with HTTPOnly so that they were less easily manipulated via XSS attacks. This patch is our solution to the problem and is offered as a possible solution for those confronted with the same issue.

Make sure ini_set('session.cookie_httponly', 1) is set in your environment - in your settings.php for example.

Note that this setting is only available in PHP 5.2 or higher. Setting it will cause cookies created by session_start to automatically be flagged to httponly. The Secure Pages Prevent Hijack module uses set_cookie, however, so this value must be explicitly set. The patch checks to see if session.cookie_httponly is set, and if so, adds the additional property. If not, set_cookie uses the original settings so that it remains compatible with earlier versions of PHP.

Patch to follow shortly.

CommentFileSizeAuthor
#1 securepages_prevent_hijack-httponly-1414844.patch933 bytesMichele Wickham

Comments

Michele Wickham’s picture

Michele Wickham commented
StatusFileSize
new securepages_prevent_hijack-httponly-1414844.patch933 bytes

Here's the patch.

rjbrown99’s picture

rjbrown99 commented

The Pressflow folks have done something similar, with a slightly different approach. Have a look here, line 1798 inside of the drupal_session_regenerate() function. Thought it was worth comparing as they have a graceful fallback for older PHP versions.