I have got a list of security violations for my website from security team. It says

Cookie without HttpOnly flag set

Autocomplete Password Enabled

So, what is this basically? Can I overcome this in my Drupal 7 site?

  • You got two comments which answered the separate questions, but both seem right to me. For the autocomplete password enabled - check out drupal.org/project/pci_update – greggles Dec 25 '11 at 21:59

Ask for the actual security report. They often contain explanations about what the problem really is, as well as offering a solution.

I believe this will take care of the password autocomplete issue; I have a client who requires this and have it deployed on a few sites.

function mymodule_form_alter (&$form, &$form_state, $form_id)
  // http://www.midwesternmac.com/blogs/jeff-geerling/disabling-autocomplete-forms

  if ($form['#id'] == 'user-login') {
    $form['#attributes']['autocomplete'] = 'off';
  • For what it's worth, there's now a very small module that does this, called PCI Update (drupal.org/project/pci_update). It also turns off autocomplete on the login block. – Matt V. Sep 27 '13 at 22:10

From the documentation for session.cookie_httponly (you should set this flag to true in your php.ini file):

Marks the cookie as accessible only through the HTTP protocol. This means that the cookie won't be accessible by scripting languages, such as JavaScript. This setting can effectively help to reduce identity theft through XSS attacks (although it is not supported by all browsers).

Check out the documentation for session.cookie_httponly.

  • 2
    You can also do this via an ini_set() in your settings.php if you don't want to make a gloabl change. – mpdonadio Dec 21 '11 at 13:50
  • @MPD - Yes and you could also use a php_flag directive in a .htaccess file. – Cyclonecode Dec 21 '11 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.