Good morning everyone, I was already asking on Discord but got redirect to the forum instead. I’m running into a small security issue where on an audit the cookie flag got revealed not being set to secure. Installed kirby version: 4.3.0 url() output: https://test- Code to generate the cookie/se…

You can secure the session cookie in your php.ini session.use_strict_mode = On session.cookie_secure = On session.use_only_cookies = On session.cookie_httponly = On

Hello @texnixe , I’m currently not able to modify the php.ini, but set it accordingly in index.php with init_set(…). At least phpinfo(); outputs it correctly. Unfortunately it still doesn’t get the secure flag.

I digged more into how kirby is creating a cookie/session for it. Seems like that Uri::scheme() is not setting/getting “https” or “ssl” correctly. That’s why kirby_session wont be secure, even if I update the php.ini. In the config I whitelisted all URLs (array) with http (localhost) and https (st…

Sorry for the delay. Looks like we missed your reply in August. About php.ini: The options @texnixe mentioned won’t take effect on sessions created by $kirby->session() as Kirby does not use PHP’s built-in session handling. Sorry for the confusion. You are right that the detected URI scheme comes …

OK, then the environment is correct. If you delete the session cookie in your browser and log in again, do you still get the missing Secure flag?

Yes. And I’m only using the csrf() helper for a form. Nothing besides that.

Hm, that suggests to me that it’s a deeper issue, like the web server or a (reverse) proxy modifying the response. You can verify this by manually calling: setcookie('test-cookie', 'some value', ['secure' => true]); Alternatively you can temporarily place var_dump($options) in this line in the Co…

I was thinking about a reverse proxy aswell, let me know if I have to reach out to the sys admin for it. manually calling setcookie does in fact set it secure. the output of the var_dump: array(5) { ["lifetime"]=> int(1729240926) ["path"]=> string(1) "/" ["secure"]=> bool(false) ["httpOnl…

Thanks for testing. That confirms that it’s not the server or reverse proxy, but something internal to Kirby or your site code. In that var_dump() output, secure should be true. If it was, the cookie would work just like the one you set manually for testing. Since we already confirmed that Uri::cu…

Secure Cookie / Session Tokens

The CMS Questions

frankallen October 17, 2024, 7:10am 6

Hello Lukas

Thank you for your reply.

I used var_dump(Kirby\Http\Uri::current()->scheme()); in a template.
The output is https.

Topic		Replies	Views
Set-Cookie twice? Questions v2	3	1721	June 12, 2017
Kirby without cookies for page visitors? Questions v2	19	3326	June 29, 2018
Problem with session Questions v3	8	646	March 6, 2020
Kirby Session Cookie Questions v2	7	2093	May 31, 2018
No CMS Session Cookie Questions v2	6	1519	March 16, 2018

Secure Cookie / Session Tokens

Related topics