Hot answers tagged

7

Yes, the cookies are still susceptible to being intercepted. The full set of cookies for matching domains is transmitted by the browser with each page request to that domain, even if the original cookies were set using HTTPS/SSL and the current page is HTTP. One way around this is by setting the "secure" flag on cookies you set. Any cookies set with the "...


5

Change the Control Panel Session Type to "Cookies only". Control Panel Location: Admin ‣ Security and Privacy ‣ Security and Sessions Only cookies are used to track the admin user. When this setting is used a “remember me” checkbox will appear next to the Control Panel login page, enabling users to stay permanently logged in.


3

The answer to this lay in the Varnish configuration. Basically, in the vcl_recv function, I created my logic for whether to "lookup" (check the cache, fetch from the backend if the cache is empty), or "pass" (always serve from the backend). Then in vcl_pass, I added an HTTP header to the request indicating "this request was passed and should never be cached"...


3

After a few weeks of attempting to track down this bug, we finally found the culprit was misconfigured cookie_domain setting. In our config file, we dynamically set the cookie domain so cookies work with our various MSM sites: $config['cookie_domain'] = '.' . preg_replace('#^www\.(.+\.)#i', '$1', $_SERVER['HTTP_HOST']); During our server switch,...


3

You can query the exp_sessions table, where you can see both the ip_address and member_id for each session. Multiple sessions from wildly different IPs would be a cue that an account was being shared widely.


2

<script type="text/javascript" src="jquery.js"></script> <script type="text/javascript" src="jquery.cookie.js"></script> This is likely your problem - you're calling your scripts in a relative fashion, but your URL likely has multiple segments, so the browser is looking for the scripts in the wrong place. Change these to absolute ...


2

This usually happens when there is a clash between the cookies. Give clearing your browser cookies, or at least delete the EE ones a try. A good way to thwart this is to set a unique cookie prefix/domain for the site/server. you can find the cookie overrides here: https://docs.expressionengine.com/latest/general/system_configuration_overrides.html I's start ...


2

This turned out to be an issue with EE 2.8, MSM, and google maps for expressionengine. Updated Google maps module to 3.3.5 and all is well


1

It's not too bad! In the control panel Settings > Consent requests create a new request called "video_consent" or similar, this name is used in the consent form, example below. Now add the following code snippet to wherever you output your video: <!-- check if the consent has NOT been granted --> {if ! consent:has_responded:ee:...


1

The answer from witrin on this question (three answers down or so) is the reason why you you are having this problem. https://stackoverflow.com/questions/3230133/accessing-cookie-immediately-after-setcookie When you set the cookie via Cookie Plus, I assume it uses the setcookie() method. This sets a header to be sent to the client; when the client receives ...


1

You might want to try this link: https://github.com/yashiel/Cookie-Consent In mcp.cookie_consent.php, line 63 will have to be changed from… $this->EE->cp->set_variable('cp_page_title', $this->EE->lang->line('cookie_consent_module_name')); …to… $this->EE->view->cp_page_title = $this->EE->lang->line('...


1

In your backend, under Settings > Security & Privacy choose CP session type to Session ID Only


1

EE3 still uses the legacy Input library internally, so the same methods apply. ee()->input->cookie(); ee()->input->set_cookie(); ee()->input->delete_cookie(); Or, use the Cookie Helper. The one new method you can use for getting a cookie is the Request service. ee('Request')->cookie($name, $default_value);


1

Not that I'm an expert, but what I've implemented in the past has been in .htaccess, not defining privacy settings in EE, until now I've not given it much thought... This answer gives some light - what you've done is set it so cookies aren't sent back from that domain for the content generated by EE, but they will still be sent in the request, therefore ...


1

You can use the $assign_to_config array in each site's index.php and admin.php files to set some per-site config items. (See docs.) But you might have better luck using a switch statement in your main config.php file, e.g., switch($_SERVER['SERVER_NAME']) { case 'www.domain.co.uk': $config['foo'] = 'bar'; break; case 'sub1.domain.co....


1

There's an add-on called Cookie Plus which makes setting and getting cookies via template tags very simple.


1

You can try Stay Up Forever It call "Forever", but based on code you can setup any session timeout in extension settings (for cpanel or/and user)


1

I just tested this (really quickly) on one of my sites running 2.8.1 and couldn't exploit the exp_csrf cookie in the way described by your report. However I could do it on your site using the exact same method. So perhaps a simple update to 2.8.1 or higher will fix the problem for you. UPDATE (from my comment) The site I tested on had no search form, ...


1

I'm having this problem too. What I do is, um, refreshing the form. You may find this bug report useful


1

Cookie Plus is fine, but if you happen to already be using Stash, it can handle this kind of thing using save="yes" scope="user" parameters (which essentially creates a cookie). https://github.com/croxton/Stash/wiki/%7Bexp%3Astash%3Aset%7D#scope--user


1

Yes do it by setting cookie and then checking for the presence/value of the cookie and use the result to decide which layout to show (perhaps by using a conditional to use a particular embedded template). As ever there are add-ons to help with getting and setting cookies, take a look at Cookies Plus as a starting point.


1

I am getting the same thing. {path='logout'} does not work This finally ended up working. I use Solspace User, not sure if that is related.. <a href="{path='?ACT=16'}&XID={XID_HASH}">Log out</a>


1

You say nothing has changed but something must have. Even if it's a change to the server set up (perhaps made by your host) it could have an effect. So it might be worth asking your host if any updates were made in the last 48 hours. This may at least give you a clue. Were any options changed in the site CP? Such as cookie settings, requiring and IP and ...


1

You can use addon Stay Up Forever for this purpose.


1

For anyone else coming across this, ExpressionEngine 2.8.0 introduced a new config variable for httponly cookies, and it's set to 'yes' by default: http://ellislab.com/expressionengine/user-guide/general/system_configuration_overrides.html#cookie-httponly-config


Only top voted, non community-wiki answers of a minimum length are eligible