Update: Thanks to Dom Stubbs, I have an extension to accomplish this now. It is up on devot-ee and also up on GitHub. Thanks Dom!

The Original Question

I am nearly through a security review of a new EE2 version of an existing EE1 site that I hope to launch soon. One of the final issues remaining is to make the cookies HttpOnly. I've tried doing that through this line in the apache config:

Header edit Set-Cookie "(?i)^((?:(?!;\s?HttpOnly).)+)$" "$1; HttpOnly"

Using the dev tools in my browser I can see that it does indeed append HttpOnly to the Set-Cookie headers, but the issue then becomes that I cannot log in. When I asked Ellislab they tell me that the cookies should not be being dealt with in javascript, which was what I expected the issue might be.

ExpressionEngine does not seem to use the session libraries from codeignitor, if it did I could set a config variable to turn httponly on, but it looks like the session handling code is in the expressionengine side of things.

The real question that I need answered is how can I make HttpOnly cookies work, but I guess that breaks down into some potential subquestions:

  1. Am I missing an addon that would allow me to do this without a lot more heartache?Is there something wrong with my apache approach? Are you able to log in if you enable that in Apache, log out and try to log back in?
  2. Is there something wrong with my apache approach? Are you able to log in if you enable that in Apache, log out and try to log back in?
  3. Failing these, can anybody give me a hint as to where cookies are being set in expressionengine so I can dig in there and try to fix this?

2 Answers 2


I've not attempted to implement HttpOnly cookies with EE, but doing so should be relatively straightforward. If you go to line 805 of Functions.php you'll see the setcookie() call EE uses. Directly above that is the set_cookie_end hook. As that receives the $data array of cookie params it would be trivial to create an extension with a custom setcookie() call. The following is untested but I think it should work:

function set_cookie_end($data)
    // Block EE's native setcookie() call
    $this->EE->extensions->end_script = TRUE; 

    // Set a HttpOnly cookie
    setcookie($data['prefix'].$data['name'], $data['value'], $data['expire'], 
        $data['path'], $data['domain'], $data['secure_cookie'], TRUE);

You can use Pkg.io to eliminate some of the hassle of creating the extension.

  • I'll give this a try tomorrow Dom and report back. Thanks!
    – UltraBob
    Nov 20, 2012 at 14:40
  • Hmm actually I don't see where that sets an http only cookie. I see it setting a secure cookie, but that's already in the configs. I've had a few beers am I just missing it?
    – UltraBob
    Nov 20, 2012 at 14:42
  • 2
    If you take a look at the setcookie docs the final parameter is $httponly, which my sample code sets as true. Before you bother with an extension I'd try adding the true parameter to EE's core code, just to verify that it works as expected.
    – Dom Stubbs
    Nov 20, 2012 at 14:47
  • 1
    I have this extension ready to go, and am happy to release it with full credit to Dom, if Dom is happy with that.
    – UltraBob
    Nov 21, 2012 at 8:07
  • 1
    If you wouldn't mind uploading it to Github & Devot-ee that'd be great. Don't worry about the credit, it's just a couple of lines of code.
    – Dom Stubbs
    Nov 21, 2012 at 8:32

For anyone else coming across this, ExpressionEngine 2.8.0 introduced a new config variable for httponly cookies, and it's set to 'yes' by default: http://ellislab.com/expressionengine/user-guide/general/system_configuration_overrides.html#cookie-httponly-config

  • Thanks James, I'll add that info to the description of the extension.
    – UltraBob
    Apr 30, 2014 at 0:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.