Update: Thanks to Dom Stubbs, I have an extension to accomplish this now. It is up on devot-ee and also up on GitHub. Thanks Dom!
The Original Question
I am nearly through a security review of a new EE2 version of an existing EE1 site that I hope to launch soon. One of the final issues remaining is to make the cookies HttpOnly. I've tried doing that through this line in the apache config:
Header edit Set-Cookie "(?i)^((?:(?!;\s?HttpOnly).)+)$" "$1; HttpOnly"
Using the dev tools in my browser I can see that it does indeed append HttpOnly to the Set-Cookie headers, but the issue then becomes that I cannot log in. When I asked Ellislab they tell me that the cookies should not be being dealt with in javascript, which was what I expected the issue might be.
ExpressionEngine does not seem to use the session libraries from codeignitor, if it did I could set a config variable to turn httponly on, but it looks like the session handling code is in the expressionengine side of things.
The real question that I need answered is how can I make HttpOnly cookies work, but I guess that breaks down into some potential subquestions:
- Am I missing an addon that would allow me to do this without a lot more heartache?Is there something wrong with my apache approach? Are you able to log in if you enable that in Apache, log out and try to log back in?
- Is there something wrong with my apache approach? Are you able to log in if you enable that in Apache, log out and try to log back in?
- Failing these, can anybody give me a hint as to where cookies are being set in expressionengine so I can dig in there and try to fix this?