Make CakeSession use httponly by default.

Fixes #2955
cakephp · Jun 13, 2012 · f625742 · f625742
1 parent f467785
commit f625742
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/lib/Cake/Model/Datasource/CakeSession.php b/lib/Cake/Model/Datasource/CakeSession.php
@@ -475,6 +475,9 @@ protected static function _configureSession() {
 		if (!isset($sessionConfig['ini']['session.gc_maxlifetime'])) {
 			$sessionConfig['ini']['session.gc_maxlifetime'] = $sessionConfig['timeout'] * 60;
 		}
+		if (!isset($sessionConfig['ini']['session.cookie_httponly'])) {
+			$sessionConfig['ini']['session.cookie_httponly'] = 1;
+		}
 
 		if (empty($_SESSION)) {
 			if (!empty($sessionConfig['ini']) && is_array($sessionConfig['ini'])) {