session cookies do not follow $wfCookieSecure
Closed, ResolvedPublic
Actions

Assigned To

None

Authored By

	• bzimport
	Jan 24 2007, 10:59 AM

Description

Author: ekb87ds02

Description:
There's a setting, $wfCookieSecure, that determines whether the cookies used by
mediawiki are supposed to be https only. This setting is not honored for the
session cookie. The interface to do that is new in PHP 4.2.0; as mediawiki now
requires PHP 5, it can be enabled.

Note that there is a similar bug 4731 for the httponly parameter, but that is
new in PHP 5.2 so it might be undesirable to enable that.

Details

Reference: bz8751

Event Timeline

• bzimport raised the priority of this task from to Medium.Nov 21 2014, 9:30 PM

• bzimport added a project: MediaWiki-User-login-and-signup.

• bzimport set Reference to bz8751.

• bzimport added a subscriber: Unknown Object (MLST).

• bzimport created this task.Jan 24 2007, 10:59 AM

ekb87ds02 wrote:

Patch to fix bug

Attached:

sessioncookiesecure.diff860 BDownload

Whoops, good catch!

Fixed in r19636

	F3501: sessioncookiesecure.diff
	Nov 21 2014, 9:30 PM

session cookies do not follow $wfCookieSecureClosed, ResolvedPublicActions

Description

Details

Event Timeline

session cookies do not follow $wfCookieSecure
Closed, ResolvedPublic
Actions