3.4.2 Cookie-based session tokens have the ‘HttpOnly’ attribute set¶
Verify that cookie-based session tokens have the ‘HttpOnly’ attribute set. (C6)
| Level 1 | X |
| Level 2 | X |
| Level 3 | X |
| CWE | NIST |
|---|---|
| 1004 | 7.1.1 |
PHP¶
Make sure the following INI settings are set to 1 (or “On”):
ini_set('session.cookie_httponly', 1);
Symfony¶
The cookie_httponly configuration option should be set to true.
Laravel¶
In config/session.php the option httponly should be set to true.