I have a Laravel site, I thought I patched this issue already.

I got these in my session.php

'secure'    => true,
'http_only' => true,

But OpenVas still detected that I still need to it.

enter image description here

It also listed it 3 times

enter image description here

Am I missing anything else ? or this is a potential false positive from OpenVas ?


From the documentation:

If set to TRUE then PHP will attempt to send the httponly flag when setting the session cookie.

From your code:

'http_only' => true,

Thus, it looks like you spelled it wrong, i.e. you spelled http_only whereas it should be httponly.


Not the answer you're looking for? Browse other questions tagged or ask your own question.