Whats the recommended way to set httponly and secure flags on the PHPSESSID cookie?
I found http://www.php.net/manual/en/session.configuration.php#ini.session.cookie-httponly . Any better suggestions?
thanks
在我看来最好的是: http : //www.php.net/manual/en/function.session-set-cookie-params.php
void session_set_cookie_params ( int $lifetime [, string $path [, string $domain [, bool $secure = false [, bool $httponly = false ]]]] )
I was unable to get the secure flag working with session_set_cookie_params(...)
, so what I did was, after session_start()
set the PHPSESSID cookie, I reset it with setcookie(...)
. The final parameter, true, makes the cookie have a secure flag.
<?php
session_start();
$currentCookieParams = session_get_cookie_params();
$sidvalue = session_id();
setcookie(
'PHPSESSID',//name
$sidvalue,//value
0,//expires at end of session
$currentCookieParams['path'],//path
$currentCookieParams['domain'],//domain
true //secure
);
?>
When I checked the PHPSESSID cookie in Firefox, its 'Send for' property was set to 'Encrypted connections only' and its 'Expires' property was set to 'At end of session'.
A more elegant solution since PHP >=7.0
session_start(['cookie_lifetime' => 43200,'cookie_secure' => true,'cookie_httponly' => true]);
我通过 HTTPS 使用 Apache httpd,设置session.cookie_httponly = 1
& session.cookie_secure = 1
对我有用。
For a WordPress website, I fixed it using the following PHP code:
add_action('init', 'start_session', 1);
function start_session() {
if(!session_id()) {
session_start();
$currentCookieParams = session_get_cookie_params();
$sidvalue = session_id();
setcookie(
'PHPSESSID',//name
$sidvalue,//value
0,//expires at end of session
$currentCookieParams['path'],//path
$currentCookieParams['domain'],//domain
true //secure
);
}
}
add_action('wp_logout','end_session');
add_action('wp_login','end_session');
function end_session() {
session_destroy();
}
Paste the code in the functions.php file.
如果您使用的是 Apache,请在您的 .htaccess 上试试这个
php_value session.cookie_httponly 1
Using .htaccess for this purpose just slows down your application.
I think its better to add this snippet in your main config file ( example config.php ) or main include file ( example global.php )
// Prevents javascript XSS attacks aimed to steal the session ID
ini_set('session.cookie_httponly', 1);
// Prevent Session ID from being passed through URLs
ini_set('session.use_only_cookies', 1);
If you are using https:// instead of http:// , then also do
// Uses a secure connection (HTTPS)
ini_set('session.cookie_secure', 1);
This method is also suitable for thos who dont have access to php.ini
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.