helpSavannah Administration - Support: sr #109705, make session cookies httponly


sr #109705: make session cookies httponly

Submitted by:  Peter Liscovius <peterdd>
Submitted on:  Tue 11 Jun 2019 05:33:46 PM UTC  
Category:  Savannah website Priority:  5 - Normal
Severity:  6 - Security Status:  Done
Assigned to:  Ineiev <ineiev> Operating System:  None
Open/Closed:  Closed

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Mon 17 Jun 2019 09:01:52 AM UTC, comment #1: 


Ineiev <ineiev>
Site AdministratorIn charge of this item.
Tue 11 Jun 2019 05:33:46 PM UTC, original submission:  

The session_hash and session_uid are not httponly, which means javascript could read document.cookie

So easy fix might changing

setcookie($name, $value, $expiration, $path, $domain, $secure);


setcookie($name, $value, $expiration, $path, $domain, $secure, true);

in frontend/php/include/session.php


Also the session cookies are, not, so any subdomain tool has access to the session (I see it was intentional made, but is it used yet anywhere?)

While has content-security-policy default 'self' which makes XSS harder, the subdomains like have not, so a XSS there could read document.cookie

By setting the httponly option for session related cookies it would be a bit harder to exploit a XSS bug.

Peter Liscovius <peterdd>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #47075:  savane_cookies.png added by peterdd (241KiB - image/png)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by peterdd (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-06-17 ineiev CategoryNone => Savannah website
        StatusNone => Done
        Assigned toNone => ineiev
        Open/ClosedOpen => Closed
    2019-06-11 peterdd Attached File- => Added savane_cookies.png, #47075

    Back to the top

    Powered by Savane 3.5