Flag session cookies with HttpOnly by default

Closes #215
agendav · Jul 3, 2017 · 6a5cc4c · 6a5cc4c
1 parent 87c5771
commit 6a5cc4c
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,7 @@
 
 - Use npm to download dependencies instead of using bower
 - Upgrade Symfony components to 2.8.22
+- Session cookies are now marked with HttpOnly flag by default (#215)
 
 ## [2.2.0] - 2017-05-23
 

diff --git a/ansible/agendav/settings.php.j2 b/ansible/agendav/settings.php.j2
@@ -81,4 +81,5 @@ $app['session.storage.options'] = [
     'gc_divisor' => 10,
     'gc_maxlifetime' => 1200,
     'lifetime' => 1200,
+    'cookie_httponly' => true,
 ];
diff --git a/web/config/prod.php b/web/config/prod.php
@@ -22,6 +22,7 @@
     // You should not change cookie_lifetime. Change 'gc_divisor', 'gc_maxlifetime' and other
     // session related settings (http://php.net/session.configuration)
     'cookie_lifetime' => 0,
+    'cookie_httponly' => true,
 ];
 
 // Languages