Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #9166 Missing HTTPOnly flag on PHP session cookie
    Actions
    Infos
    #9166
    Thomas Gerbet (tgerbet)
    2016-12-22 13:35
    2016-05-20 15:02
    9436
    Details
    Missing HTTPOnly flag on PHP session cookie

    The session cookie used by PHP can be accessed by client side script code.

    Impact

    The content of the cookie can be stolen by an attacker to mount more complex attacks.
    CVSS3 score: 5.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)

    References

    https://www.owasp.org/index.php/HttpOnly
    https://tools.ietf.org/html/rfc6265#section-5.2.6

    Other
    All
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Empty
    Closed
    2016-05-23
    Attachments
    Artifact links
    Empty
    Empty
    References
    Referencing request #9166

    Artifact Tracker v5

    rel #8982 8.15

    Git commit

    tuleap/tuleap/stable

    Merge commit 'refs/changes/29/5729/2' of ssh://gerrit.tuleap.net:29418/tuleap into HEAD fb010e2b8a
    User avatar Yannis ROSSETTO (rossettoy) , 2016-05-23 10:37
    request #9166: Session cookie have the flag HTTPOnly and Secure if possible ad3c2e187d
    User avatar Thomas Gerbet (tgerbet) , 2016-05-23 09:02

    Release

    release #124
    Referenced by request #9166

    Other

    gerrit #5729
    Display settings

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2016-05-23 12:02
    Integrated into Tuleap 8.14.99.75.
    • Status changed from Under review to Closed
    • Close date set to 2016-05-23