1

I am using the eu cookie compliance module in Drupal 9 and I need to change the "secure" and "httpOnly" values of the cookies, as I am getting a vulnerability error "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute". I have tested from the settings.php using the following code:

ini_set('session.cookie_secure', 1);

However it didn't work, I also tried with some modules but it didn't work either. enter image description here

6
  • What is the Drupal version? What module produces those cookies?
    – cilefen
    Jan 10, 2023 at 20:27
  • I am using drupal 9 Jan 10, 2023 at 20:28
  • Which module produces those cookies? You did not say that in the question. I am downvoting the question until you add that information.
    – cilefen
    Jan 10, 2023 at 20:30
  • I am using the eu cookie compliance module Jan 10, 2023 at 20:31
  • Please add that information to the Question. Also, for what it's worth, those are not PHP session cookies so ini_set('session.cookie_secure', 1) will not do anything to change these cookies..
    – cilefen
    Jan 10, 2023 at 20:34

1 Answer 1

1

By looking over the 8.x-1.x branch of that module, what you are asking seems to be unsupported there. It sets cookies like:

cookies.set(cookieName, status, { path: path, domain: domain, sameSite: 'strict' });

However, cookies.set supports all the possible options.

So the answer to this question is: Open a feature request with the module maintainers, or patch the files in the js directory, or both.

2
  • wow thank you very much my friend Jan 10, 2023 at 21:05
  • Please accept the answer.
    – cilefen
    Jan 10, 2023 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.