From 00e4e0294f36f8e4a0c5926efdc16b31fcb4c788 Mon Sep 17 00:00:00 2001 From: Lukas Fleischer Date: Thu, 11 Aug 2011 16:31:25 +0200 Subject: Use secure and httponly session cookies As discussed on the mailing list, enable "secure" and "httponly" for session cookies to prevent them from being transferred over insecure connections. Signed-off-by: Lukas Fleischer --- web/html/logout.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'web/html') diff --git a/web/html/logout.php b/web/html/logout.php index dee6456a..1cdf453d 100644 --- a/web/html/logout.php +++ b/web/html/logout.php @@ -15,7 +15,7 @@ if (isset($_COOKIE["AURSID"])) { $q.= mysql_real_escape_string($_COOKIE["AURSID"]) . "'"; db_query($q, $dbh); # setting expiration to 1 means '1 second after midnight January 1, 1970' - setcookie("AURSID", "", 1, "/"); + setcookie("AURSID", "", 1, "/", null, !empty($_SERVER['HTTPS']), true); unset($_COOKIE['AURSID']); } -- cgit v1.2.3-24-g4f1b