I am familiar with the cakePHP cookie and session settings but I am unsure as to why (when analyzing through the Burp Proxy Suite I am finding 2 separate Set-Cookie responses:

Set-Cookie: DropZone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
Set-Cookie: DropZone=spackr9fhhgod0lqk9glh3ch44; expires=Tue, 28-Jan-2014 23:01:37 GMT; path=/; secure; HttpOnly

I have taken the time to set the HTTPOnly and Secure flags. What I don't understand is the first line here:

Set-Cookie: DropZone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/

Where could this Set-Cookie header be coming from? More importantly, could this be more than an informational security threat?

I am clearly in my app/Config/core.php file setting the Session settings:

Configure::write('Session', array(
    'defaults' => 'php',
    'cookie' => 'DropZone',
    'timeout' => 15,
    'ini' => array(
        'session.cookie_secure' => true,
        'session.cookie_httponly' => true)
  • 1
    The line is deleting the old cookie before setting a new one. Jan 30, 2014 at 10:27
  • Note that this is very bad behavior; multiple Set-Cookie headers is well attested to in PHP but RFC 6265 says "Servers SHOULD NOT include more than one Set-Cookie header field in the same response with the same cookie-name."
    – Brad Koch
    Jul 26, 2014 at 1:09

1 Answer 1


This is actually coming from where CakePHP is renewing its session. Culprit can be found at:

CakePHP 2.4: https://github.com/cakephp/cakephp/blob/2.4/lib/Cake/Model/Datasource/CakeSession.php#L686

CakePHP 2.6: https://github.com/cakephp/cakephp/blob/2.6/lib/Cake/Model/Datasource/CakeSession.php#L721

And the documentation in setcookie has clearly said that:

Cookies must be deleted with the same parameters as they were set with. If the value argument is an empty string, or FALSE, and all other arguments match a previous call to setcookie, then the cookie with the specified name will be deleted from the remote client. This is internally achieved by setting value to 'deleted' and expiration time to one year in past.

This is why you get a non-httponly setcookie call from whenever your session is renewing, especially you are doing a logout action.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .