I have got a list of security violations for my website from security team. It says

Cookie without HttpOnly flag set

Autocomplete Password Enabled

So, what is this basically? Can I overcome this in my Drupal 7 site?

  • You got two comments which answered the separate questions, but both seem right to me. For the autocomplete password enabled - check out drupal.org/project/pci_update
    – greggles
    Commented Dec 25, 2011 at 21:59

2 Answers 2


Ask for the actual security report. They often contain explanations about what the problem really is, as well as offering a solution.

I believe this will take care of the password autocomplete issue; I have a client who requires this and have it deployed on a few sites.

function mymodule_form_alter (&$form, &$form_state, $form_id)
  // http://www.midwesternmac.com/blogs/jeff-geerling/disabling-autocomplete-forms

  if ($form['#id'] == 'user-login') {
    $form['#attributes']['autocomplete'] = 'off';
  • For what it's worth, there's now a very small module that does this, called PCI Update (drupal.org/project/pci_update). It also turns off autocomplete on the login block.
    – Matt V.
    Commented Sep 27, 2013 at 22:10

From the documentation for session.cookie_httponly (you should set this flag to true in your php.ini file):

Marks the cookie as accessible only through the HTTP protocol. This means that the cookie won't be accessible by scripting languages, such as JavaScript. This setting can effectively help to reduce identity theft through XSS attacks (although it is not supported by all browsers).

Check out the documentation for session.cookie_httponly.

  • 2
    You can also do this via an ini_set() in your settings.php if you don't want to make a gloabl change.
    – mpdonadio
    Commented Dec 21, 2011 at 13:50
  • @MPD - Yes and you could also use a php_flag directive in a .htaccess file. Commented Dec 21, 2011 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.