Page MenuHomePhabricator

session cookies do not follow $wfCookieSecure
Closed, ResolvedPublic


Author: ekb87ds02

There's a setting, $wfCookieSecure, that determines whether the cookies used by
mediawiki are supposed to be https only. This setting is not honored for the
session cookie. The interface to do that is new in PHP 4.2.0; as mediawiki now
requires PHP 5, it can be enabled.

Note that there is a similar bug 4731 for the httponly parameter, but that is
new in PHP 5.2 so it might be undesirable to enable that.

See also

Version: unspecified
Severity: normal
OS: Windows XP
Platform: PC



Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 9:30 PM
bzimport set Reference to bz8751.
bzimport added a subscriber: Unknown Object (MLST).

ekb87ds02 wrote:

Patch to fix bug


Whoops, good catch!

Fixed in r19636