Take the 2-minute tour ×
ExpressionEngine® Answers is a question and answer site for administrators, end users, developers and designers for ExpressionEngine® CMS. It's 100% free, no registration required.

Update: Thanks to Dom Stubbs, I have an extension to accomplish this now. It is up on devot-ee and also up on GitHub. Thanks Dom!

The Original Question

I am nearly through a security review of a new EE2 version of an existing EE1 site that I hope to launch soon. One of the final issues remaining is to make the cookies HttpOnly. I've tried doing that through this line in the apache config:

Header edit Set-Cookie "(?i)^((?:(?!;\s?HttpOnly).)+)$" "$1; HttpOnly"

Using the dev tools in my browser I can see that it does indeed append HttpOnly to the Set-Cookie headers, but the issue then becomes that I cannot log in. When I asked Ellislab they tell me that the cookies should not be being dealt with in javascript, which was what I expected the issue might be.

ExpressionEngine does not seem to use the session libraries from codeignitor, if it did I could set a config variable to turn httponly on, but it looks like the session handling code is in the expressionengine side of things.

The real question that I need answered is how can I make HttpOnly cookies work, but I guess that breaks down into some potential subquestions:

  1. Am I missing an addon that would allow me to do this without a lot more heartache?Is there something wrong with my apache approach? Are you able to log in if you enable that in Apache, log out and try to log back in?
  2. Is there something wrong with my apache approach? Are you able to log in if you enable that in Apache, log out and try to log back in?
  3. Failing these, can anybody give me a hint as to where cookies are being set in expressionengine so I can dig in there and try to fix this?
share|improve this question
add comment

2 Answers 2

up vote 3 down vote accepted

I've not attempted to implement HttpOnly cookies with EE, but doing so should be relatively straightforward. If you go to line 805 of Functions.php you'll see the setcookie() call EE uses. Directly above that is the set_cookie_end hook. As that receives the $data array of cookie params it would be trivial to create an extension with a custom setcookie() call. The following is untested but I think it should work:

function set_cookie_end($data)
{
    // Block EE's native setcookie() call
    $this->EE->extensions->end_script = TRUE; 

    // Set a HttpOnly cookie
    setcookie($data['prefix'].$data['name'], $data['value'], $data['expire'], 
        $data['path'], $data['domain'], $data['secure_cookie'], TRUE);
}

You can use Pkg.io to eliminate some of the hassle of creating the extension.

share|improve this answer
    
I'll give this a try tomorrow Dom and report back. Thanks! –  UltraBob Nov 20 '12 at 14:40
    
Hmm actually I don't see where that sets an http only cookie. I see it setting a secure cookie, but that's already in the configs. I've had a few beers am I just missing it? –  UltraBob Nov 20 '12 at 14:42
2  
If you take a look at the setcookie docs the final parameter is $httponly, which my sample code sets as true. Before you bother with an extension I'd try adding the true parameter to EE's core code, just to verify that it works as expected. –  Dom Stubbs Nov 20 '12 at 14:47
1  
I have this extension ready to go, and am happy to release it with full credit to Dom, if Dom is happy with that. –  UltraBob Nov 21 '12 at 8:07
1  
If you wouldn't mind uploading it to Github & Devot-ee that'd be great. Don't worry about the credit, it's just a couple of lines of code. –  Dom Stubbs Nov 21 '12 at 8:32
show 2 more comments

For anyone else coming across this, ExpressionEngine 2.8.0 introduced a new config variable for httponly cookies, and it's set to 'yes' by default: http://ellislab.com/expressionengine/user-guide/general/system_configuration_overrides.html#cookie-httponly-config

share|improve this answer
    
Thanks James, I'll add that info to the description of the extension. –  UltraBob Apr 30 at 0:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.