2

In Magento 1

I can see many of the cookie are without Secure flag and HttpOnly set on website.

Is their any way to set Secure flag and HttpOnly set on all server Cookie ?

I need to make all server cookie secure.

I have tried “Use HTTP Only” option in Magento to add "httponly" flag in cookies.

System > Configuration > General > Web > Session Cookie Management

It works but not for all cookies. Also i have tried

override isSecure method from Mage_Core_Model_Cookie model, method:

public function isSecure() {

return $this->_getRequest()->isSecure();

}

But, This does not work. Any thoughts on this ?

Thankyou

  • Any thoughts ?? – Hamendra Sunthwal Oct 13 at 5:16
  • Which cookies does it not work for? Are those cookies set by Magento or an externally loaded asset? – snez Oct 13 at 13:02
  • Hello, it does not set "Httponly" attribute to cookies created from magento function – Hamendra Sunthwal Oct 13 at 13:42
  • You say "It works but not for all cookies", which cookies are those? – snez Oct 14 at 12:15
  • it does not set "Httponly" attribute to cookies created from magento function – Hamendra Sunthwal Oct 14 at 12:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.