A minor advisory was issued on our last update suggesting HTTPOnly should be set (or at least configurable) the the RSESS and USESS cookies.

CommentFileSizeAuthor
#4 esi-secure_and_httponly_cookie_params-1910274-4.patch1.74 KBneilnz
#2 esi-secure_and_httponly_cookie_params-1910274-1.patch1.21 KBryanellis
#1 esi-secure_and_httponly_cookie_params-1910274-1.patch0 bytesryanellis

Comments

ryanellis’s picture

ryanellis commented
StatusFileSize
new esi-secure_and_httponly_cookie_params-1910274-1.patch0 bytes
ryanellis’s picture

ryanellis commented
StatusFileSize
new esi-secure_and_httponly_cookie_params-1910274-1.patch1.21 KB
mikeytown2’s picture

mikeytown2 commented

will the ajax method still work with this patch?

neilnz’s picture

neilnz commented
Version: 6.x-2.0-beta1 » 6.x-2.x-dev
StatusFileSize
new esi-secure_and_httponly_cookie_params-1910274-4.patch1.74 KB

Here's a version that won't set httponly if ajax fallback is enabled. Should be safe now?

dstuart’s picture

dstuart commented
Issue summary: View changes
Status: Active » Closed (outdated)

No longer supported