http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=9102
Katrin Fischer <katrin.fisc...@bsz-bw.de> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #13580|0 |1
is obsolete| |
--- Comment #12 from Katrin Fischer <katrin.fisc...@bsz-bw.de> ---
Created attachment 14384
-->
http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=14384&action=edit
[SIGNED-OFF] Bug 9102 : Set HttpOnly on the CGISESSID cookie
https://www.owasp.org/index.php/HttpOnly
Signed-off-by: Kyle M Hall <k...@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer...@web.de>
To test, use curl
Before the patch
% curl -I http://192.168.2.135
HTTP/1.1 200 OK
Date: Sun, 18 Nov 2012 06:56:49 GMT
Server: Apache/2.2.22 (Ubuntu)
Pragma: no-cache
Cache-control: no-cache
Content-script-type: text/javascript
Content-style-type: text/css
Set-Cookie: CGISESSID=19689f6e7d8ec94c25269fecebf2f009; path=/
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
After patch
% curl -I http://192.168.2.135
HTTP/1.1 200 OK
Date: Sun, 18 Nov 2012 07:01:04 GMT
Server: Apache/2.2.22 (Ubuntu)
Pragma: no-cache
Cache-control: no-cache
Content-script-type: text/javascript
Content-style-type: text/css
Set-Cookie: CGISESSID=da25baf03c0bc1e2c512a627028e43e6; path=/; HttpOnly
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
--
You are receiving this mail because:
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list
Koha-bugs@lists.koha-community.org
http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
