1

I am trying to modify the 'has_js' cookie that is set by Drupal. I need to modify this cookie so it becomes both Http-only and secure in response to a site security review.

I attempted to add the following to the html.tpl.php file so the cookie would be modified before any output was rendered:

setcookie('has_js',null,null,null,null,true,true);
setrawcookie('has_js',null,null,null,null,true,true);

This gave me 2 has_js cookies, one with the desired modifications and one without.

I next attempted to grab the value from the original has_js cookie and then destroy it and replace it:

if(isset($_COOKIE['has_js']))
{
  $has = $_COOKIE['has_js']; //save cookie's value (i.e., '1')
  unset($_COOKIE['has_js']);
  setcookie('has_js','',time()-3600); //destroy old cookie
  setcookie('has_js',$has,null,null,null,true,true);
  setrawcookie('has_js',$has,null,null,null,true,true);
}
else
{
  print_r("Not set");
}

This demonstrates (by the output I get) that at the start of html.tpl.php, the cookie isn't set -- which might explain why there are 2 cookies (perhaps I was creating a has_js cookie at one point in time and after that Drupal creates its own). Confusingly, if I simply do

print_r($_COOKIE); 

at the same place in the file, 'has_js' cookie does show up with an assigned value of 1.

So my question is:

How can I find out when Drupal is setting this 'has_js' cookie and how can I add these attributes to it?

  • Drupal sets it in a core JS file (/misc/drupal.js) – thumbson Feb 20 '15 at 14:57
  • Thank you. Do you know of a way to modify the cookie once it has been set without delving into core file changes? – 15shn Feb 23 '15 at 17:02
  • You could try adding a custom js file that runs after the core file and set the cookie that way – thumbson Feb 24 '15 at 5:29
0

I am answering this formally so other people can see one possible solution that will work if they have this same question, but the answer is actually found in the comment by @thumbson above: in order to modify the cookie, I did indeed find success in creating a custom js file that ran when every page loads.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.