Permalink
Browse files

Make CakeSession use httponly by default.

Fixes #2955
  • Loading branch information...
markstory committed Jun 13, 2012
1 parent f467785 commit f625742a12151afca34c1587bb199602ffbce633
Showing with 3 additions and 0 deletions.
  1. +3 −0 lib/Cake/Model/Datasource/CakeSession.php
@@ -475,6 +475,9 @@ protected static function _configureSession() {
if (!isset($sessionConfig['ini']['session.gc_maxlifetime'])) {
$sessionConfig['ini']['session.gc_maxlifetime'] = $sessionConfig['timeout'] * 60;
}
+ if (!isset($sessionConfig['ini']['session.cookie_httponly'])) {
+ $sessionConfig['ini']['session.cookie_httponly'] = 1;
+ }
if (empty($_SESSION)) {
if (!empty($sessionConfig['ini']) && is_array($sessionConfig['ini'])) {

0 comments on commit f625742

Please sign in to comment.