I have got a list of security violations for my website from security team. It says
Cookie without HttpOnly flag set
Autocomplete Password Enabled
So, what is this basically? Can I overcome this in my Drupal 7 site?
-
You got two comments which answered the separate questions, but both seem right to me. For the autocomplete password enabled - check out drupal.org/project/pci_update– gregglesCommented Dec 25, 2011 at 21:59
Add a comment
|
2 Answers
Ask for the actual security report. They often contain explanations about what the problem really is, as well as offering a solution.
I believe this will take care of the password autocomplete issue; I have a client who requires this and have it deployed on a few sites.
function mymodule_form_alter (&$form, &$form_state, $form_id)
{
// http://www.midwesternmac.com/blogs/jeff-geerling/disabling-autocomplete-forms
if ($form['#id'] == 'user-login') {
$form['#attributes']['autocomplete'] = 'off';
}
}
answered Dec 21, 2011 at 13:48
-
For what it's worth, there's now a very small module that does this, called PCI Update (drupal.org/project/pci_update). It also turns off autocomplete on the login block.– Matt V.Commented Sep 27, 2013 at 22:10
From the documentation for session.cookie_httponly (you should set this flag to true in your php.ini file):
Marks the cookie as accessible only through the HTTP protocol. This means that the cookie won't be accessible by scripting languages, such as JavaScript. This setting can effectively help to reduce identity theft through XSS attacks (although it is not supported by all browsers).
-
2You can also do this via an ini_set() in your settings.php if you don't want to make a gloabl change.– mpdonadio ♦Commented Dec 21, 2011 at 13:50
-
@MPD - Yes and you could also use a
php_flagdirective in a.htaccessfile. Commented Dec 21, 2011 at 13:52