Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:16870
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <008601c5778b$88c1f820$0201a8c0@PC1>
To: "Jochen Hansper" <hansper@t-online.de>, <internals@lists.php.net>
References: <1119485004.7376.20.camel@mframe.test-lab>
Date: Wed, 22 Jun 2005 19:36:02 -0500
MIME-Version: 1.0
Content-Type: text/plain;
	charset="Windows-1252"
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] httpOnly Cookies [tiny enhancement]
From: php_lists@realplain.com ("Matt W")

Hi,

Supporting the httpOnly thing is good, but is a php.ini setting better than
another setcookie() parameter?  I thought that's how it would be
implemented...  Well, I guess we can use ini_set().


Matt

----- Original Message ----- 
From: "Jochen Hansper" <hansper@t-online.de>
Sent: Wednesday, June 22, 2005 7:03 PM
Subject: [PHP-DEV] httpOnly Cookies [tiny enhancement]


> Hi,
>
> Internet Explorer 6 SP1 supports the cookie attribute "httponly" which
> prevents reading cookies from JavaScript or the like. This can help to
> mitigate XSS session hijacking. Browsers not supporting this cookie
> attribute are not disturbed if it is present.
>
> AFAIK PHP does not support httponly cookies. So here's a patch that will
> add support for it in PHP4.
> (files ext/session/session.c and ext/session/session_php.h have to be
> changed)
>
> After you apply the changes (and recompile), you can add a line like
> this in php.ini:
>
> session.cookie_httponly=1
>
> It enables httpOnly cookies. Default value ist 0 (off, if line is
> missing).