Secure cookie setting not working? | ww.wp.xz.cn

Resolved Ate Up With Motor
(@ate-up-with-motor)

7 years, 11 months ago

I’ve been trying to use the plugin to improve the security of my site — I’m new to SSL/TLS connections and a lot of the fine points are mystifying to me.

I went into the HTTP Headers security settings, turned on Cookie security, and checked both Secure and HttpOnly. However, when I check the site with Mozilla Observatory, it says that the Secure header is not being set for cookies. Isn’t the plugin setting supposed to force Secure for all cookies? Am I misunderstanding, or have I done something wrong?

Thanks!

The page I need help with: [log in to see the link]

Viewing 5 replies - 1 through 5 (of 5 total)

Plugin Author Dimitar Ivanov
(@zinoui)

7 years, 11 months ago
Hi @ate-up-with-motor,

This plugin will set the httpOnly flag and the Secure flag to all the cookies send by your server (WordPress, other PHP scripts, etc.)
For example:
```
<?php
setcookie('some name', 'some value', 0, '/');
?>
```
I found that cookies from your site who are not HttpOnly and not Secure are all set by the browser, through-out some javascript libraries:

https://ateupwithmotor.com/contentfiles/plugins/ga-germanized/assets/js/cookieconsent.js?ver=3.0.3
cookieconsent_status

https://ateupwithmotor.com/contentfiles/plugins/gdpr/assets/js/gdpr-public.js?ver=2.1.0
```
gdpr[consent_types]
gdpr[allowed_cookies]
gdpr[privacy_bar]
```
Thread Starter Ate Up With Motor
(@ate-up-with-motor)

7 years, 11 months ago

Hmm. Is it possible to have the JavaScript set cookies to use those settings?

Plugin Author Dimitar Ivanov
(@zinoui)

7 years, 11 months ago

I don’t think so.
Guess you need to modify the source code of those libraries.

Thread Starter Ate Up With Motor
(@ate-up-with-motor)

7 years, 11 months ago

Ahh, okay. This seems like something I should take up with the developers of the plugins setting those scripts. Thanks for helping me understand the issue!

Plugin Author Dimitar Ivanov
(@zinoui)

7 years, 11 months ago

You welcome.

Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘Secure cookie setting not working?’ is closed to new replies.

Tags

5 replies
2 participants
Last reply from: Dimitar Ivanov
Last activity: 7 years, 11 months ago
Status: resolved