#6271: Solution to #5254 does not allow for "opting out" of the security measure ------------------------+--------------------------------------------------- Reporter: Ocean | Owner: Type: RFC | Status: new Priority: Medium | Milestone: 1.2.x.x Component: Session | Version: 1.2 Final Severity: Normal | Resolution: Keywords: | Php_version: n/a Cake_version: | ------------------------+--------------------------------------------------- Comment (by Ocean):
Having read #4341, is this the correct (cake-esque) way to go? or am I barking up the wrong tree? (answers on a postcard please)... {{{ app/config/core.php /** * When set to false, cookie_secure will not automatically be set in an HTTPS environment * (anti "Surf Jacking": http://resources.enablesecurity.com/resources/Surf%20Jacking.pdf) */ Configure::write('Session.cookieSecure', true); }}} {{{ cake/libs/session.php - Session::__initSession() if ($iniSet && env('HTTPS') && Configure::read('Session.cookieSecure')) { ini_set('session.cookie_secure', 1); } }}} -- Ticket URL: <https://trac.cakephp.org/ticket/6271#comment:1> CakePHP : The Rapid Development Framework for PHP <https://trac.cakephp.org/> Cake is a rapid development framework for PHP which uses commonly known design patterns like ActiveRecord, Association Data Mapping, Front Controller and MVC. Our primary goal is to provide a structured framework that enables PHP users at all levels to rapidly develop robust web applications, without any loss to flexibility. --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "tickets cakephp" group. To post to this group, send email to tickets-cakephp@googlegroups.com To unsubscribe from this group, send email to tickets-cakephp+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/tickets-cakephp?hl=en -~----------~----~----~----~------~----~------~--~---