4

In scanning a Drupal 7 site with Qualys, we're getting the issue

150122 Cookie Does Not Contain The "secure" Attribute

Is there a way to systematically add the Secure vs HTTPOnly flag to cookies? Would Secure Cookie Data serve this? If so, how do I test that Cookies are secure?

Moreover, this site automatically forwards to https. The user spends no time over port 80 but instead is directly shuttled to 443. We have an administrator who wants nothing but to see this test passed; regardless of the previous fact.

The Cookie in Question:

has_js=1

enter image description here

Would the following in settings.php be sufficient:

ini_set('session.cookie_secure', 1);
ini_set('session.cookie_httponly', 1);
2

Which cookie is this? All of Drupal 8's cookies are secure.

The exception is BigPipe's no-JS cookie, see https://www.drupal.org/node/2678628 — but there are no security consequences there.

If that's the one that is triggering this alert, then the problem is clear: your security testing tool is making blanket statements that don't make sense.

|improve this answer|||||
  • I've adjusted my question to denote Drupal 7. – Rick Mar 16 '16 at 17:00
  • I just got this finding from our security scan on Drupal 8 also. – zkent Oct 22 '18 at 17:04
2

It appears I can tell Apache to do this for me:

Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure

enter image description here

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.