HttpOnly cookie in CodeIgniter

Hi Guys,

I have developed an application using CodeIgniter 2.1.3.

The application has gone to security review and it has been reported that the ci_session cookie will need HttpOnly flag. 

I have seen the session.php file in system/libraries and it has a function called _set_cookie.

I would like to know if any modification in this file is needed or there is some other way.

Best regards,

A security audit would also tell you that you must upgrade to CI3, at which point this won't be an issue.

Upgrading to CI3 is not an option. I have to resolve it with CI 2.1.3 only. Please help

Best regards,

Seriusly? You are developer and u can't write in google 'php how to set http_only cookie'?
In system/library/Session.php:688 add comma at end, and in next line type 'true' (as bollean ofc)
If in that place isn't any variable how you wanna put there something?

when we ask a question on a forum the hardes insult is ... look at google

Seriusly? You are developer and u can't write in google 'php how to set http_only cookie'?
In system/library/Session.php:688 add comma at end, and in next line type 'true' (as bollean ofc)
If in that place isn't any variable how you wanna put there something?

Dont act too smart Nick
I have searched google and found that httponly cookie is not implemented in CI 2.1.3 and only after that I have posted in this forum. We can see in session.php itself that cookie_httponly  is not set

Code:

foreach (array('sess_encrypt_cookie', 'sess_use_database', 'sess_table_name', 'sess_expiration', 'sess_expire_on_close', 'sess_match_ip', 'sess_match_useragent', 'sess_cookie_name', 'cookie_path', 'cookie_domain', 'cookie_secure', 'sess_time_to_update', 'time_reference', 'cookie_prefix', 'encryption_key') as $key)

Common sense should prevail.

Upgrading to CI3 is not an option. I have to resolve it with CI 2.1.3 only. Please help

Best regards,

Then you'll never be secure. You might as well say "Improving our security is not an option".

If you're running CI2, lack of an httpOnly flag on a cookies is the least of your problems.

New users to the forums should read the Forum Rules!

What did you Try? What did you Get? What did you Expect?

Joined CodeIgniter Community 2009.  ( Skype: insitfx )

Seriusly? You are developer and u can't write in google 'php how to set http_only cookie'?
In system/library/Session.php:688 add comma at end, and in next line type 'true' (as bollean ofc)
If in that place isn't any variable how you wanna put there something?

Dont act too smart Nick
I have searched google and found that httponly cookie is not implemented in CI 2.1.3 and only after that I have posted in this forum. We can see in session.php itself that cookie_httponly  is not set

Code:

foreach (array('sess_encrypt_cookie', 'sess_use_database', 'sess_table_name', 'sess_expiration', 'sess_expire_on_close', 'sess_match_ip', 'sess_match_useragent', 'sess_cookie_name', 'cookie_path', 'cookie_domain', 'cookie_secure', 'sess_time_to_update', 'time_reference', 'cookie_prefix', 'encryption_key') as $key)

Common sense should prevail.

Step by Step doc how to use cookie_httponly

https://www.codeigniter.com/user_guide/i...e_214.html
https://www.codeigniter.com/user_guide/i...e_220.html
https://www.codeigniter.com/user_guide/i...e_300.html
https://www.codeigniter.com/user_guide/i...e_310.html
https://www.codeigniter.com/user_guide/i...e_311.html
https://www.codeigniter.com/user_guide/i...e_312.html
https://www.codeigniter.com/user_guide/i...e_313.html
https://www.codeigniter.com/user_guide/i...e_314.html

or you change this line (bad way):

https://github.com/bcit-ci/CodeIgniter/b...n.php#L668


if you care about security update you code. 5 year old codeigniter code is not secure.

Titre :
Problème avec les cookies HttpOnly en PHP et JavaScript — Impossible de les lire en front-end

Description :
Bonjour à tous,

Je travaille sur une application PHP avec gestion de connexion et j'essaie de mettre en place un système de cookies HttpOnly pour sécuriser le stockage du JWT (ou token d'authentification). Cependant, je rencontre des difficultés pour faire fonctionner correctement les cookies HttpOnly.

Ce que j'ai mis en place :
Lors de la connexion, j'encode un JWT en PHP et je le stocke dans un cookie HttpOnly comme ceci :
$response->setCookie(
'token', // nom
$token, // valeur
3600, // durée en secondes
'/', // chemin
'', // domaine
false, // sécurisé (je le définis sur false pour tester en local)
true, // HttpOnly
'Strict' // SameSite
);

En front-end, je tente de lire ce cookie via JavaScript, mais il semble que le cookie ne soit pas accessible, comme prévu, car il est HttpOnly. Cependant, cela empêche mon front-end de l'utiliser pour les requêtes API.

Problème rencontré :
Je comprends que les cookies HttpOnly ne peuvent pas être lus directement via JavaScript, mais comment puis-je les utiliser pour les requêtes API ?

Faut-il que je les envoie manuellement dans l'en-tête des requêtes HTTP (comme un token Authorization) ou est-ce que le serveur est censé automatiquement lire le cookie HttpOnly ?

Existe-t-il des configurations spécifiques que je dois vérifier pour que ce mécanisme fonctionne correctement en production ?

Ce que j'ai testé :
J'ai essayé d'ajouter l'option Secure au cookie pour activer la sécurité HTTPS, mais le problème persiste (même après avoir testé en environnement local).

J'ai également vérifié que le domaine du cookie est correctement défini.

Mon objectif :
Je souhaite garder les cookies HttpOnly pour plus de sécurité, mais je veux aussi être en mesure de les utiliser pour l'authentification des requêtes côté client sans exposer le token à JavaScript.

En résumé :
Les cookies HttpOnly ne sont pas accessibles en JavaScript, mais je veux savoir comment les utiliser pour l'authentification des requêtes API.

Dois-je configurer quelque chose de spécifique pour faire cela correctement ?

Merci d'avance pour votre aide !