Zend Framework, Sessions, and HttpOnly

Question

I want to make my session cookie HttpOnly. Based on this article, I added this to my application.ini:

resources.session.cookie_httponly = true

Unfortunately, when I look at the session cookie in Firecookie, it is not marked as HttpOnly as I have specified. What step am I missing?

Overriding

"when I look at the session cookie in Firecookie, it is not marked as HttpOnly" --- how exactly cookie should be marked? What did you expect to see there? – Excogitate

HttpOnly is a step to protect from XSS: codinghorror.com/blog/2008/08/… – Overriding

@Sonny: it is a step to protect against cookies hijacking, not xss. XSS is just a way to send the cookies, and HttpOnly is the option that does not allow you to read cookies from js. So it protects cookie from being readed in js. There is no connection between XSS and HttpOnly. – Excogitate

FTA: "HttpOnly cookies are a great idea, and properly implemented, make huge classes of common XSS attacks much harder to pull off." – Overriding

@Sonny: omg... HttpOnly protects from cookie being read. Without this option your site is not more XSS vulnerable. – Excogitate

Why are you being argumentative rather than helpful? This is not the only step I take for security, I just want to use all available tools. – Overriding

@Sonny: I just corrected you, because your phrase "I want to make my session cookie HttpOnly to reduce XSS vulnerabilities" is just wrong and I do care of future not-experienced readers who will follow your words. – Excogitate

Well, on-topic now: Have you looked at the response headers? – Excogitate

When I look at the Response and Request headers in Firebug, I can see a Set-Cookie line that specifies HttpOnly, but this is for a cookie other than my session cookie. Firecookie shows an HttpOnly column, and the cookie I am specifying HttpOnly is marked as such, but my session is not. I don't know where else to look. – Overriding

if it helps, removing the PHP session cookie and starting the session again is the first test for testing. Mine worked with only the ini setting – Nock

Answer 1

Try at bootstrap to do Zend_Session::setOptions(array('cookie_httponly' => true)); ( somewhere before the session is first initialized ) tough it should work with the app.ini file too .

Fern

This works. I wish I could figure out why it's not reading from application.ini. – Overriding

will have a look and let you know if i find something . – Fern

Use Zend_Session::setOptions(array('cookie_httponly' => true)); instead of Zend_Session::setOptions(array('cookie_httponly', true)); – Erubescence

Answer 2

Add this to your application.ini file.

phpSettings.session.cookie_httponly = true

Brave

Answer 3

For this to be 100% safe.

The server should not allow the option http trace. The http option trace reports the session id. If a attacker can inject a java applet, flash or javascript with ajax the attacker can also steal cookies even with the httponly flag set...

Vouge