-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
set cookieHTTPOnly not work #2999
Comments
Yes i agree, i saw in the session class that when it sets the cookie does not include this config option
So its always TRUE and i also see a comment there saying
And of course it is a security issue because anyone with javascript knowledge can hack you app by creating random cookies to login without any post requests.. May i ask, why you want to do this ? |
By the way if your doing what i think your trying to do you can always set another cookie via cookie helper with that option being off. set_cookie(); |
That param should only be ignored for the session. If you do it via the cookie_helper, it should apply. @perspolise please provide a code example and a better explanation for context so we can actually debug. |
@lonnieezell : ie: I check for default cookie config in
this not work and u can see always: cookie |
Security Is First. But for example: Codeigniter have a big problem with regenerate csrf token( for example: in action for fix csrf regenerate token, if I set |
@perspolise We also set that header. I believe we provide a similar solution to Laravel in that respect but I don't recall all of the details of that PR. However, the big question is: what does that have to do with HTTPOnly on cookies? I'm confused. Additionally, you never provided where/how you check the value of that cookie, or an example we can recreate. I believe the only place it's used is in the Response class where it pulls it from the config and then later when it allows your config file setting to override the value in setCookie(). |
in this case: in action for fix csrf regenerate token, if I set |
Ah, you were pointing to example where they were using a header so I was missing the connection. Or I skimmed the solution too quickly :) Either way, if there's an underlying issue with httponly value not being able to be changed then it definitely needs addressed. With the exception of session cookies, all others should currently respect the value you use when you specify it with Can you provide an example (in code) where this isn't working? |
in my code, first post data is ok, but in second i see error 403. another example: search, sort and ... in datatables plugin and much more js code(ajax post method). |
@perspolise This doesn't prove that cookies.HTTPOnly doesn't work, and, unless my coffee hasn't kicked in yet, doesn't deal with cookies at all. This is related to CSRF and AJAX, which you will find a number of posts on the forum. Please check there, and ask if you need help. There are many willing to help out there. Since this doesn't appear to be a bug, I'm closing this issue. |
I set
cookieHTTPOnly
tofalse
like this:public $cookieHTTPOnly = false;
but in action not work:
The text was updated successfully, but these errors were encountered: