-
Notifications
You must be signed in to change notification settings - Fork 89
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add secure flag to cookie for HTTPS sites #54
Comments
Yeah that's good if the application is |
The tight coupling to port 443 is problematic in that PR. There is risk though for sites that aren't guaranteed https all the time, so perhaps a default-off configuration option instead. |
yeah it can be made configurable with |
feel free to send a PR, with config value as something like |
Implemented with 6f12262 |
While assisting with a site that has incorporated this project, I noticed that the CSRF cookie is set without the secure flag. As a feature request, consider setting the secure flag in the
setcookie()
call when the code can detect it is running under HTTPS (via$_SERVER['HTTPS']
for example) or as a configurable option.The text was updated successfully, but these errors were encountered: