Make session cookies HttpOnly on Apache
Why it matters
Scripts on the page can read a session cookie without HttpOnly, so any cross-site scripting bug lets an attacker steal the login. HttpOnly hides the cookie from JavaScript while the browser still sends it with requests.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Stage 1: check that no front-end code needs to read the cookie. Fixing the flag in the application or php.ini is better than rewriting it in Apache.
- Stage 2: if the application cannot be changed, the lines below append HttpOnly to the named cookie (replace session_cookie_name with the name from the finding). Reload and test logging in.
apache
Header onsuccess edit Set-Cookie "(?i)^(session_cookie_name=(?!.*;\s*httponly\b).*)$" "$1; HttpOnly" Header always edit Set-Cookie "(?i)^(session_cookie_name=(?!.*;\s*httponly\b).*)$" "$1; HttpOnly"
Related
Scan your domain to see whether this applies to you.