How or Where to Set HttpOnly flag for Cookies : Vulnerability found in Security Audit

[mahimamm]

Hi All,

I am new to the world of Joomla , so I am not sure if this is a basic question or if there are threads already with good solutions for this.... If so please help me without links without judgements as I was not able to find anything sufficient....

Recently I developed a Joomla website, in the Security one of the issues they pointed out was that "Cookie without HttpOnly flag set", I tried my best to pinpoint the area where I can set this flag, I am using Joomla 3x in the latest version.

I see that in my configurations httponly is set to "On" locally and set to "Off" globally and again from some of the threads I was able to understand that I need to make some changes in the session file, but not very clear of exactly what to do, kindly throw some light....

Thanks in advance.

[itoctopus]

Have you tried adding the following to a local (e.g. under the directory containing the Joomla website) php.ini or .user.ini file?

Code: Select all

session.cookie_httponly = 1
session.use_only_cookies = 1

In other words, create a php.ini file or a .user.ini file at the same level of the configuration.php file, and add the above code to it. The above should take effect without restarting Apache.

The problem is that if you do this, then JavaScript will not be able to access the cookies directly and it might be that Joomla or a non-core extension that you're using relies on that - I am not sure and I hope someone from the Joomla core team clarifies that. Personally I haven't tested it so I'm not sure it works. Nevertheless, it's worth a try - but, if it works, makes sure that you test your website thoroughly afterwards.

If I may ask, which vulnerability scanner are you using?

[mahimamm]

Thanks a lot for the reply :-)

Is there any other sources where I can read about the solution you have suggested and its effects?

It was an OWASP Top 10 Vulnerabilities based scan and I believe the tools were (Core impact professional R 1.32015
Acunetix 10.5 Web Vulnerability Scanner, HP Web Inspect 16.10)

[mahimamm]

Hi itoctopus,

Thanks a lot for the solution. It worked :-).

Updating in case it might help anyone :-).

Thanks a lot.

Mahima M M