How can I enable HttpOnly cookies in EE

Question

Update: Thanks to Dom Stubbs, I have an extension to accomplish this now. It is up on devot-ee and also up on GitHub. Thanks Dom!

The Original Question

I am nearly through a security review of a new EE2 version of an existing EE1 site that I hope to launch soon. One of the final issues remaining is to make the cookies HttpOnly. I've tried doing that through this line in the apache config:

Header edit Set-Cookie "(?i)^((?:(?!;\s?HttpOnly).)+)$" "$1; HttpOnly"

Using the dev tools in my browser I can see that it does indeed append HttpOnly to the Set-Cookie headers, but the issue then becomes that I cannot log in. When I asked Ellislab they tell me that the cookies should not be being dealt with in javascript, which was what I expected the issue might be.

ExpressionEngine does not seem to use the session libraries from codeignitor, if it did I could set a config variable to turn httponly on, but it looks like the session handling code is in the expressionengine side of things.

The real question that I need answered is how can I make HttpOnly cookies work, but I guess that breaks down into some potential subquestions:

1. Am I missing an addon that would allow me to do this without a lot more heartache?Is there something wrong with my apache approach? Are you able to log in if you enable that in Apache, log out and try to log back in?
2. Is there something wrong with my apache approach? Are you able to log in if you enable that in Apache, log out and try to log back in?
3. Failing these, can anybody give me a hint as to where cookies are being set in expressionengine so I can dig in there and try to fix this?

Answer 1

I've not attempted to implement HttpOnly cookies with EE, but doing so should be relatively straightforward. If you go to line 805 of Functions.php you'll see the setcookie() call EE uses. Directly above that is the set_cookie_end hook. As that receives the $data array of cookie params it would be trivial to create an extension with a custom setcookie() call. The following is untested but I think it should work:

function set_cookie_end($data)
{
    // Block EE's native setcookie() call
    $this->EE->extensions->end_script = TRUE; 

    // Set a HttpOnly cookie
    setcookie($data['prefix'].$data['name'], $data['value'], $data['expire'], 
        $data['path'], $data['domain'], $data['secure_cookie'], TRUE);
}

You can use Pkg.io to eliminate some of the hassle of creating the extension.

Answer 2

For anyone else coming across this, ExpressionEngine 2.8.0 introduced a new config variable for httponly cookies, and it's set to 'yes' by default: http://ellislab.com/expressionengine/user-guide/general/system_configuration_overrides.html#cookie-httponly-config