In scanning a Drupal 7 site with Qualys, we're getting the issue
150122 Cookie Does Not Contain The "secure" Attribute
Is there a way to systematically add the Secure vs HTTPOnly flag to cookies? Would Secure Cookie Data serve this? If so, how do I test that Cookies are secure?
Moreover, this site automatically forwards to https. The user spends no time over port 80 but instead is directly shuttled to 443. We have an administrator who wants nothing but to see this test passed; regardless of the previous fact.
The Cookie in Question:
Would the following in settings.php be sufficient:
ini_set('session.cookie_secure', 1); ini_set('session.cookie_httponly', 1);