Set the domain attribute to secure cookies for the 'remember me' option

[watchix]

I'm searching where is created the 'Cacti' cookie (This name seems to be the PHP session_name(); ) in order to modify the domain of this cookie.

Actually the domain of this cookie is "cacti.my-domain.org" and i would change it by "my-domain.com" to use this cookie in an extranet to display some graph.

It seems that this cookie is created by a PHP file, because then i disable JavaScript in Chrome or Firefox this cookie appear on https://cacti.my-domain.com/index.php

I tried to edit theses files, in vain
root@xxxxxxx:/usr/share/cacti/site# grep -e "setcookie" * -R
auth_changepassword.php: setcookie($cacti_session_name, null, -1, $config['url_path']);
auth_login.php: setcookie(session_name(), '', time() - 3600, $config['url_path']);
include/auth.php://setcookie(session_name(), '', 0, $config['url_path'], "wiconect.fr", 1);
include/csrf/csrf-magic.php: setcookie($GLOBALS['csrf']['cookie'], $val, time() + 3600, $config['url_path']);
install/index.php: setcookie(session_name(),'',time() - 3600, $config['url_path']);
lib/auth.php: setcookie('cacti_remembers', '', time() - 3600, $config['url_path']);
lib/auth.php: setcookie('cacti_remembers', $user['username'] . ',' . $nssecret, time()+(86400*30), $config['url_path']);
logout.php:setcookie(session_name(), '', time() - 3600, $config['url_path']);
root@xxxxxxx:/usr/share/cacti/site#

Cacti version : 1.1.28

Here is some screens on my first forum request :
https://forums.cacti.net/viewtopic.php?f=21&t=60757&sid=95f817d6424554f49b225bef3d21ff46

[TheWitness]

Okay, this is fixed. You need to look at the updated config.php.dist. It includes a new variable "$cacti_cookie_domain". Just set that variable and you will be off to the races. Please test the full 1.2.x branch and provide feedback when you have finished.

[watchix]

Hello @TheWitness thanks a lot for your help :)

It's now ok. 👍
Despite a migration problem with a modulo zero.
I had to edit the "lib/api_poller.php" like you said in this topic : https://forums.cacti.net/viewtopic.php?f=2&t=27553

Regards,

[TheWitness]

If you grab the latest lib/api_poller.php from the 1.2.x branch, this should not occur. Can you confirm?

[TheWitness]

I'll go ahead and close now. You could do us a favor though. If you can goto the documentation site and add that to the documentation? Do a pull request. We would greatly appreciate you returning the favor.

[TheWitness]

It's here, if you could take a swipe at documenting the entire config.php.dist, that would be awesome!

https://github.com/Cacti/documentation