Cookie Security (HTTPOnly-/Secure-Flag)

sasl · January 2012

Hi,

It would be nice if it is possible to set this for the cookies (Cookie Persistence).
Will this feature be available in one of the next releases?

RFC 6265 (Chapter: 4.1.2.6. The HttpOnly Attribute)

Regards

mischa · January 2012

You can do this today with aFleX.

when HTTP_RESPONSE {
 if { [HTTP::header exists "Set-Cookie"] } {
   set cookie_value [HTTP::cookie "TestCookie"]
   HTTP::cookie remove "TestCookie"
   HTTP::header insert "Set-Cookie" "TestCookie=$cookie_value; HttpOnly"
 }
}

sasl · January 2012

thx mischa for this hint, very usefull for me!

Cookie Security (HTTPOnly-/Secure-Flag)

Comments