The Original Question
I am nearly through a security review of a new EE2 version of an existing EE1 site that I hope to launch soon. One of the final issues remaining is to make the cookies HttpOnly. I've tried doing that through this line in the apache config:
Header edit Set-Cookie "(?i)^((?:(?!;\s?HttpOnly).)+)$" "$1; HttpOnly"
ExpressionEngine does not seem to use the session libraries from codeignitor, if it did I could set a config variable to turn httponly on, but it looks like the session handling code is in the expressionengine side of things.
The real question that I need answered is how can I make HttpOnly cookies work, but I guess that breaks down into some potential subquestions:
- Am I missing an addon that would allow me to do this without a lot more heartache?Is there something wrong with my apache approach? Are you able to log in if you enable that in Apache, log out and try to log back in?
- Is there something wrong with my apache approach? Are you able to log in if you enable that in Apache, log out and try to log back in?
- Failing these, can anybody give me a hint as to where cookies are being set in expressionengine so I can dig in there and try to fix this?