Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add secure flag to cookie for HTTPS sites #54

Closed
mberkowski opened this issue Oct 11, 2016 · 5 comments
Closed

Add secure flag to cookie for HTTPS sites #54

mberkowski opened this issue Oct 11, 2016 · 5 comments

Comments

@mberkowski
Copy link
Contributor

While assisting with a site that has incorporated this project, I noticed that the CSRF cookie is set without the secure flag. As a feature request, consider setting the secure flag in the setcookie() call when the code can detect it is running under HTTPS (via $_SERVER['HTTPS'] for example) or as a configurable option.

@mebjas
Copy link
Owner

mebjas commented Oct 11, 2016

Yeah that's good if the application is https only, which sadly isn't a generic case as of now. Check this thread #48, there was a PR for the same. You could use it though if the app is actually https only.

@mberkowski
Copy link
Contributor Author

The tight coupling to port 443 is problematic in that PR. There is risk though for sites that aren't guaranteed https all the time, so perhaps a default-off configuration option instead.

@mebjas
Copy link
Owner

mebjas commented Oct 11, 2016

yeah it can be made configurable with default off.

@mebjas
Copy link
Owner

mebjas commented Oct 11, 2016

feel free to send a PR, with config value as something like httpsOnly let's say

@mebjas
Copy link
Owner

mebjas commented Nov 4, 2016

Implemented with 6f12262

@mebjas mebjas closed this as completed Nov 4, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants