2

I am getting this message from my security audit:

Cookie name: "PHPSESSID"

Cookie domain: "xxx.xxx.xx.xxx"

If possible, you should set the HTTPOnly flag for this cookie.

How can I set the HTTPOnly flag for this cookie?

closed as off-topic by Stephane, schroeder, Xander, Mark, Graham Hill Jul 4 '15 at 21:51

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Mark, Graham Hill
If this question can be reworded to fit the rules in the help center, please edit the question.

5

You have at least 3 ways to achieve that:

  1. In the PHP configuration file (php.ini), look for session.cookie_httponly setting and set it to True.

  2. If you don't have access to PHP configuration, you can try to overwrite this setting at runtime:

ini_set("session.cookie_httponly", 1);
  1. If it doesn't work, you have to manually overwrite that cookie:
session_start();
$params = session_get_cookie_params();
setcookie("PHPSESSID", session_id(), 0, $params["path"], $params["domain"],
    false,  // this is the secure flag you need to set. Default is false.
    true  // this is the httpOnly flag you need to set
);

setcookie() definition:

bool setcookie ( string $name [, string $value = "" [, int $expire = 0 [, string $path = "" [, string $domain = "" [, bool $secure = false [, bool $httponly = false ]]]]]] )
  • this code is not working error The page isn't redirecting properly – srinivas reddy Jul 3 '15 at 8:37
  • If you eg. use over-restricted hosting, your server configuration may prevent you from implementing all above solutions. You should then contact your administrator and ask directly about turning on session.cookie_httponly setting. – Tomasz Klim Jul 3 '15 at 9:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.