Introducing compatibility layers

 - Limited support for mbstring (mb_strlen(), mb_strpos(), mb_substr() only) via iconv.
   Falls back to regular strlen(), strpos(), substr() if iconv is not available.
 - Password hashing, dependant on CRYPT_BLOWFISH (2y version, available since PHP 5.3.7) availability.

7 files changed, 582 insertions, 0 deletions

diff --git a/system/core/CodeIgniter.php b/system/core/CodeIgniter.php
index 70d6ca53f..270988a1b 100644
--- a/system/core/CodeIgniter.php
+++ b/system/core/CodeIgniter.php
@@ -184,6 +184,15 @@ defined('BASEPATH') OR exit('No direct script access allowed');
 
 /*
  * ------------------------------------------------------
+ *  Load compatibility features
+ * ------------------------------------------------------
+ */
+
+	require_once(BASEPATH.'core/compat/mbstring.php';
+	require_once(BASEPATH.'core/compat/password.php';
+
+/*
+ * ------------------------------------------------------
  *  Instantiate the UTF-8 class
  * ------------------------------------------------------
  */
diff --git a/system/core/compat/mbstring.php b/system/core/compat/mbstring.php
new file mode 100644
index 000000000..91ea8017c
--- /dev/null
+++ b/system/core/compat/mbstring.php
@@ -0,0 +1,141 @@
+<?php
+/**
+ * CodeIgniter
+ *
+ * An open source application development framework for PHP 5.2.4 or newer
+ *
+ * NOTICE OF LICENSE
+ *
+ * Licensed under the Open Software License version 3.0
+ *
+ * This source file is subject to the Open Software License (OSL 3.0) that is
+ * bundled with this package in the files license.txt / license.rst.  It is
+ * also available through the world wide web at this URL:
+ * http://opensource.org/licenses/OSL-3.0
+ * If you did not receive a copy of the license and are unable to obtain it
+ * through the world wide web, please send an email to
+ * licensing@ellislab.com so we can send you a copy immediately.
+ *
+ * @package		CodeIgniter
+ * @author		EllisLab Dev Team
+ * @copyright	Copyright (c) 2008 - 2014, EllisLab, Inc. (http://ellislab.com/)
+ * @license		http://opensource.org/licenses/OSL-3.0 Open Software License (OSL 3.0)
+ * @link		http://codeigniter.com
+ * @since		Version 3.0
+ * @filesource
+ */
+defined('BASEPATH') OR exit('No direct script access allowed');
+
+/**
+ * PHP ext/mbstring compatibility package
+ *
+ * @package		CodeIgniter
+ * @subpackage	CodeIgniter
+ * @category	Compatibility
+ * @author		Andrey Andreev
+ * @link		http://codeigniter.com/user_guide/
+ * @link		http://php.net/mbstring
+ */
+
+// ------------------------------------------------------------------------
+
+if (MB_ENABLED === TRUE)
+{
+	return;
+}
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('mb_strlen'))
+{
+	/**
+	 * mb_strlen()
+	 *
+	 * WARNING: This function WILL fall-back to strlen()
+	 * if iconv is not available!
+	 *
+	 * @link	http://php.net/mb_strlen
+	 * @param	string	$str
+	 * @param	string	$encoding
+	 * @return	string
+	 */
+	function mb_strlen($str, $encoding = NULL)
+	{
+		if (ICONV_ENABLED === TRUE)
+		{
+			return iconv_strlen($str, isset($charset) ? $charset : config_item('charset'));
+		}
+
+		log_message('debug', 'Compatibility (mbstring): iconv_strlen() is not available, falling back to strlen().');
+		return strlen($str);
+	}
+}
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('mb_strpos'))
+{
+	/**
+	 * mb_strpos()
+	 *
+	 * WARNING: This function WILL fall-back to strpos()
+	 * if iconv is not available!
+	 *
+	 * @link	http://php.net/mb_strpos()
+	 * @param	string	$haystack
+	 * @param	string	$needle
+	 * @param	int	$offset
+	 * @param	string	$encoding
+	 * @return	mixed
+	 */
+	function mb_strpos($haystack, $needle, $offset = 0, $encoding = NULL)
+	{
+		if (ICONV_ENABLED === TRUE)
+		{
+			return iconv_strpos($haystack, $needle, $offset, isset($encoding) ? $encoding : config_item('charset'));
+		}
+
+		log_message('debug', 'Compatibility (mbstring): iconv_strpos() is not available, falling back to strpos().');
+		return strpos($haystack, $needle, $offset);
+	}
+}
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('mb_substr'))
+{
+	/**
+	 * mb_substr()
+	 *
+	 * WARNING: This function WILL fall-back to substr()
+	 * if iconv is not available.
+	 *
+	 * @link	http://php.net/mb_substr
+	 * @param	string	$str
+	 * @param	int	$start
+	 * @param	int 	$length
+	 * @param	string	$encoding
+	 * @return	string
+	 */
+	function mb_substr($str, $start, $length = NULL, $encoding = NULL)
+	{
+		if (ICONV_ENABLED === TRUE)
+		{
+			isset($encoding) OR $encoding = config_item('charset');
+			return iconv_substr(
+				$str,
+				$start,
+				isset($length) ? $length : iconv_strlen($str, $encoding), // NULL doesn't work
+				$encoding
+			);
+		}
+
+		log_message('debug', 'Compatibility (mbstring): iconv_substr() is not available, falling back to substr().');
+		return isset($length)
+			? substr($str, $start, $length)
+			: substr($str, $start);
+	}
+}
+
+/* End of file mbstring.php */
+/* Location: ./system/core/compat/mbstring.php */
\ No newline at end of file
diff --git a/system/core/compat/password.php b/system/core/compat/password.php
new file mode 100644
index 000000000..92fdedb99
--- /dev/null
+++ b/system/core/compat/password.php
@@ -0,0 +1,216 @@
+<?php
+/**
+ * CodeIgniter
+ *
+ * An open source application development framework for PHP 5.2.4 or newer
+ *
+ * NOTICE OF LICENSE
+ *
+ * Licensed under the Open Software License version 3.0
+ *
+ * This source file is subject to the Open Software License (OSL 3.0) that is
+ * bundled with this package in the files license.txt / license.rst.  It is
+ * also available through the world wide web at this URL:
+ * http://opensource.org/licenses/OSL-3.0
+ * If you did not receive a copy of the license and are unable to obtain it
+ * through the world wide web, please send an email to
+ * licensing@ellislab.com so we can send you a copy immediately.
+ *
+ * @package		CodeIgniter
+ * @author		EllisLab Dev Team
+ * @copyright	Copyright (c) 2008 - 2014, EllisLab, Inc. (http://ellislab.com/)
+ * @license		http://opensource.org/licenses/OSL-3.0 Open Software License (OSL 3.0)
+ * @link		http://codeigniter.com
+ * @since		Version 3.0
+ * @filesource
+ */
+defined('BASEPATH') OR exit('No direct script access allowed');
+
+/**
+ * PHP ext/standard/password compatibility package
+ *
+ * @package		CodeIgniter
+ * @subpackage	CodeIgniter
+ * @category	Compatibility
+ * @author		Andrey Andreev
+ * @link		http://codeigniter.com/user_guide/
+ * @link		http://php.net/password
+ */
+
+// ------------------------------------------------------------------------
+
+if (is_php('5.5') OR ! is_php('5.3.7') OR ! defined('CRYPT_BLOWFISH') OR CRYPT_BLOWFISH !== 1)
+{
+	return;
+}
+
+// ------------------------------------------------------------------------
+
+defined('PASSWORD_BCRYPT') OR define('PASSWORD_BCRYPT', 1);
+defined('PASSWORD_DEFAULT') OR define('PASSWORD_DEFAULT', PASSWORD_BCRYPT);
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('password_get_info'))
+{
+	/**
+	 * password_get_info()
+	 *
+	 * @link	http://php.net/password_get_info
+	 * @param	string	$hash
+	 * @return	array
+	 */
+	function password_get_info($hash)
+	{
+		return (strlen($hash) < 60 OR sscanf($hash, '$2y$%d', $hash) !== 1)
+			? array('algo' => 0, 'algoName' => 'unknown', 'options' => array())
+			: array('algo' => 1, 'algoName' => 'bcrypt', 'options' => array('cost' => $hash));
+	}
+}
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('password_hash'))
+{
+	/**
+	 * password_hash()
+	 *
+	 * @link	http://php.net/password_hash
+	 * @param	string	$password
+	 * @param	int	$algo
+	 * @param	array	$options
+	 * @return	mixed
+	 */
+	function password_hash($password, $algo, array $options = array())
+	{
+		if ($algo !== 1)
+		{
+			trigger_error('password_hash(): Unknown hashing algorithm: '.(int) $algo, E_USER_WARNING);
+			return NULL;
+		}
+
+		if (isset($options['cost']) && ($options['cost'] < 4 OR $options['cost'] > 31))
+		{
+			trigger_error('password_hash(): Invalid bcrypt cost parameter specified: '.(int) $options['cost'], E_USER_WARNING);
+			return NULL;
+		}
+
+		if (isset($options['salt']) && strlen($options['salt']) < 22)
+		{
+			trigger_error('password_hash(): Provided salt is too short: '.strlen($options['salt']).' expecting 22', E_USER_WARNING);
+			return NULL;
+		}
+		elseif ( ! isset($options['salt']))
+		{
+			if (defined('MCRYPT_DEV_URANDOM'))
+			{
+				$options['salt'] = mcrypt_create_iv(16, MCRYPT_DEV_URANDOM);
+			}
+			elseif (function_exists('openssl_random_pseudo_bytes'))
+			{
+				$options['salt'] = openssl_random_pseudo_bytes(16);
+			}
+			elseif (DIRECTORY_SEPARATOR === '/' && (is_readable($dev = '/dev/arandom') OR is_readable($dev = '/dev/urandom')))
+			{
+				if (($fp = fopen($dev, 'rb')) === FALSE)
+				{
+					log_message('error', 'compat/password: Unable to open '.$dev.' for reading.');
+					return FALSE;
+				}
+
+				$options['salt'] = '';
+				for ($read = 0; $read < 16; $read = strlen($options['salt']))
+				{
+					if (($read = fread($fp, 16 - $read)) === FALSE)
+					{
+						log_message('error', 'compat/password: Error while reading from '.$dev.'.');
+						return FALSE;
+					}
+					$options['salt'] .= $read;
+				}
+
+				fclose($fp);
+			}
+			else
+			{
+				log_message('error', 'compat/password: No CSPRNG available.');
+				return FALSE;
+			}
+
+			$options['salt'] = str_replace('+', '.', rtrim(base64_encode($options['salt']), '='));
+		}
+		elseif ( ! preg_match('#^[a-zA-Z0-9./]+$#D', $options['salt']))
+		{
+			$options['salt'] = str_replace('+', '.', rtrim(base64_encode($options['salt']), '='));
+		}
+
+		isset($options['cost']) OR $options['cost'] = 10;
+		return crypt($password, sprintf('$2y$%02d$%s', $options['cost'], $options['salt']));
+	}
+}
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('password_needs_rehash'))
+{
+	/**
+	 * password_needs_rehash()
+	 *
+	 * @link	http://php.net/password_needs_rehash
+	 * @param	string	$hash
+	 * @param	int	$algo
+	 * @param	array	$options
+	 * @return	bool
+	 */
+	function password_needs_rehash($hash, $algo, array $options = array())
+	{
+		$info = password_get_info($hash);
+
+		if ($algo !== $info['algo'])
+		{
+			return TRUE;
+		}
+		elseif ($algo === 1)
+		{
+			$options['cost'] = isset($options['cost']) ? (int) $options['cost'] : 10;
+			return ($info['options']['cost'] !== $options['cost']);
+		}
+
+		// Odd at first glance, but according to a comment in PHP's own unit tests,
+		// because it is an unknown algorithm - it's valid and therefore doesn't
+		// need rehashing.
+		return FALSE;
+	}
+}
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('password_verify'))
+{
+	/**
+	 * password_verify()
+	 *
+	 * @link	http://php.net/password_verify
+	 * @param	string	$password
+	 * @param	string	$hash
+	 * @return	bool
+	 */
+	function password_verify($password, $hash)
+	{
+		if (strlen($hash) !== 60 OR strlen($password = crypt($password, $hash)) !== 60)
+		{
+			return FALSE;
+		}
+
+		$compare = 0;
+		for ($i = 0; $i < 60; $i++)
+		{
+			$compare |= (ord($password[$i]) ^ ord($hash[$i]));
+		}
+
+		return ($compare === 0);
+	}
+}
+
+/* End of file password.php */
+/* Location: ./system/core/compat/password.php */
\ No newline at end of file
diff --git a/tests/Bootstrap.php b/tests/Bootstrap.php
index 7f10ea1d6..439c7fdab 100644
--- a/tests/Bootstrap.php
+++ b/tests/Bootstrap.php
@@ -63,6 +63,9 @@ else
 	defined('ICONV_ENABLED') OR define('ICONV_ENABLED', FALSE);
 }
 
+include_once SYSTEM_PATH.'core/compat/mbstring.php';
+include_once SYSTEM_PATH.'core/compat/password.php';
+
 include_once $dir.'/mocks/autoloader.php';
 spl_autoload_register('autoload');
 
diff --git a/tests/codeigniter/core/compat/mbstring_test.php b/tests/codeigniter/core/compat/mbstring_test.php
new file mode 100644
index 000000000..415222446
--- /dev/null
+++ b/tests/codeigniter/core/compat/mbstring_test.php
@@ -0,0 +1,54 @@
+<?php
+
+class mbstring_test extends CI_TestCase {
+
+	public function test_bootstrap()
+	{
+		if (MB_ENABLED)
+		{
+			return $this->markTestSkipped('ext/mbstring is loaded');
+		}
+
+		$this->assertTrue(function_exists('mb_strlen'));
+		$this->assertTrue(function_exists('mb_substr'));
+	}
+
+	// ------------------------------------------------------------------------
+
+	/**
+	 * @depends	test_bootstrap
+	 */
+	public function test_mb_strlen()
+	{
+		$this->assertEquals(ICONV_ENABLED ? 4 : 8, mb_strlen('тест'));
+		$this->assertEquals(ICONV_ENABLED ? 4 : 8, mb_strlen('тест', 'UTF-8'));
+	}
+
+	// ------------------------------------------------------------------------
+
+	/**
+	 * @depends	test_boostrap
+	 */
+	public function test_mb_strpos()
+	{
+		$this->assertEquals(ICONV_ENABLED ? 3 : 6, mb_strpos('тест', 'с'));
+		$this->assertFalse(mb_strpos('тест', 'с', 3));
+		$this->assertEquals(ICONV_ENABLED ? 3 : 6, mb_strpos('тест', 'с', 1, 'UTF-8'));
+	}
+
+	// ------------------------------------------------------------------------
+
+	/**
+	 * @depends	test_boostrap
+	 */
+	public function test_mb_substr()
+	{
+		$this->assertEquals(ICONV_ENABLED ? 'стинг' : 'естинг', mb_substr('тестинг', 2));
+		$this->assertEquals(ICONV_ENABLED ? 'нг' : 'г', mb_substr('тестинг', -2));
+		$this->assertEquals(ICONV_ENABLED ? 'ст' : 'е', mb_substr('тестинг', 2, 2));
+		$this->assertEquals(ICONV_ENABLED ? 'стинг' : 'естинг', mb_substr('тестинг', 2, 'UTF-8'));
+		$this->assertEquals(ICONV_ENABLED ? 'нг' : 'г', mb_substr('тестинг', -2, 'UTF-8'));
+		$this->assertEquals(ICONV_ENABLED ? 'ст' : 'е', mb_substr('тестинг', 2, 2, 'UTF-8'));
+	}
+
+}
\ No newline at end of file
diff --git a/tests/codeigniter/core/compat/password_test.php b/tests/codeigniter/core/compat/password_test.php
new file mode 100644
index 000000000..4014e7415
--- /dev/null
+++ b/tests/codeigniter/core/compat/password_test.php
@@ -0,0 +1,158 @@
+<?php
+
+class password_test extends CI_TestCase {
+
+	public function test_bootstrap()
+	{
+		if (is_php('5.5'))
+		{
+			return $this->markTestSkipped('ext/standard/password is available on PHP 5.5');
+		}
+		elseif ( ! is_php('5.3.7'))
+		{
+			$this->assertFalse(defined('PASSWORD_BCRYPT'));
+			return $this->markTestSkipped("PHP versions prior to 5.3.7 don't have the '2y' Blowfish version");
+		}
+		elseif ( ! defined('CRYPT_BLOWFISH') OR CRYPT_BLOWFISH !== 1)
+		{
+			$this->assertFalse(defined('PASSWORD_BCRYPT'));
+			return $this->markTestSkipped('CRYPT_BLOWFISH is not available');
+		}
+
+		$this->assertTrue(defined('PASSWORD_BCRYPT'));
+		$this->assertTrue(defined('PASSWORD_DEFAULT'));
+		$this->assertEquals(1, PASSWORD_BCRYPT);
+		$this->assertEquals(PASSWORD_BCRYPT, PASSWORD_DEFAULT);
+		$this->assertTrue(function_exists('password_get_info'));
+		$this->assertTrue(function_exists('password_hash'));
+		$this->assertTrue(function_exists('password_needs_rehash'));
+		$this->assertTrue(function_exists('password_verify'));
+	}
+
+	// ------------------------------------------------------------------------
+
+	/**
+	 * password_get_info() test
+	 *
+	 * Borrowed from PHP's own tests
+	 *
+	 * @depends	test_bootstrap
+	 */
+	public function test_password_get_info()
+	{
+		$expected = array(
+			'algo' => 1,
+			'algoName' => 'bcrypt',
+			'options' => array('cost' => 10)
+		);
+
+		// default
+		$this->assertEquals($expected, password_get_info('$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y'));
+
+		$expected['options']['cost'] = 11;
+
+		// cost
+		$this->assertEquals($expected, password_get_info('$2y$11$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y'));
+
+		$expected = array(
+			'algo' => 0,
+			'algoName' => 'unknown',
+			'options' => array()
+		);
+
+		// invalid length
+		$this->assertEquals($expected, password_get_info('$2y$11$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100'));
+
+		// non-bcrypt
+		$this->assertEquals($expected, password_get_info('$1$rasmusle$rISCgZzpwk3UhDidwXvin0'));
+	}
+
+	// ------------------------------------------------------------------------
+
+	/**
+	 * password_hash() test
+	 *
+	 * Borrowed from PHP's own tests
+	 *
+	 * @depends	test_bootstrap
+	 */
+	public function test_password_hash()
+	{
+		// FALSE is returned if no CSPRNG source is available
+		if ( ! defined('MCRYPT_DEV_URANDOM') && ! function_exists('openssl_random_pseudo_bytes')
+			&& (DIRECTORY_SEPARATOR !== '/' OR ! is_readable('/dev/arandom') OR ! is_readable('/dev/urandom'))
+			)
+		{
+			$this->assertFalse(password_hash('foo', PASSWORD_BCRYPT));
+		}
+		else
+		{
+			$this->assertEquals(60, strlen(password_hash('foo', PASSWORD_BCRYPT)));
+			$this->assertTrue(($hash = password_hash('foo', PASSWORD_BCRYPT)) === crypt('foo', $hash));
+		}
+
+		$this->assertEquals(
+			'$2y$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi',
+			password_hash('rasmuslerdorf', PASSWORD_BCRYPT, array('cost' => 7, 'salt' => 'usesomesillystringforsalt'))
+		);
+
+		$this->assertEquals(
+			'$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y',
+			password_hash('test', PASSWORD_BCRYPT, array('salt' => '123456789012345678901'.chr(0)))
+		);
+	}
+
+	// ------------------------------------------------------------------------
+
+	/**
+	 * password_needs_rehash() test
+	 *
+	 * Borrowed from PHP's own tests
+	 *
+	 * @depends	test_password_get_info
+	 */
+	public function test_password_needs_rehash()
+	{
+		// invalid hash: always rehash
+		$this->assertTrue(password_needs_rehash('', PASSWORD_BCRYPT));
+
+		// valid, because it's an unknown algorithm
+		$this->assertFalse(password_needs_rehash('', 0));
+
+		// valid with same cost
+		$this->assertFalse(password_needs_rehash('$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y', PASSWORD_BCRYPT, array('cost' => 10)));
+
+		// valid with same cost and additional parameters
+		$this->assertFalse(password_needs_rehash('$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y', PASSWORD_BCRYPT, array('cost' => 10, 'foo' => 3)));
+
+		// invalid: different (lower) cost
+		$this->assertTrue(password_needs_rehash('$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y', PASSWORD_BCRYPT, array('cost' => 09)));
+
+		// invalid: different (higher) cost
+		$this->assertTrue(password_needs_rehash('$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y', PASSWORD_BCRYPT, array('cost' => 11)));
+
+		// valid with default cost
+		$this->assertFalse(password_needs_rehash('$2y$'.str_pad(10, 2, '0', STR_PAD_LEFT).'$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y', PASSWORD_BCRYPT));
+
+		// invalid: 'foo' is cast to 0
+		$this->assertTrue(password_needs_rehash('$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y', PASSWORD_BCRYPT, array('cost' => 'foo')));
+	}
+
+	// ------------------------------------------------------------------------
+
+	/**
+	 * password_verify() test
+	 *
+	 * Borrowed from PHP's own tests
+	 *
+	 * @depends	test_bootstrap
+	 */
+	public function test_password_verify()
+	{
+		$this->assertFalse(password_verify(123, 123));
+		$this->assertFalse(password_verify('foo', '$2a$07$usesomesillystringforsalt$'));
+		$this->assertFalse(password_verify('rasmusler', '$2a$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi'));
+		$this->assertTrue(password_verify('rasmuslerdorf', '$2a$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi'));
+	}
+
+}
\ No newline at end of file
diff --git a/user_guide_src/source/changelog.rst b/user_guide_src/source/changelog.rst
index b5b31dcc2..ce84b7f54 100644
--- a/user_guide_src/source/changelog.rst
+++ b/user_guide_src/source/changelog.rst
@@ -499,6 +499,7 @@ Release Date: Not Released
       -  ``UTF8_ENABLED`` now requires only one of `Multibyte String <http://php.net/mbstring>`_ or `iconv <http://php.net/iconv>`_ to be available instead of both.
       -  Changed method ``clean_string()`` to utilize ``mb_convert_encoding()`` if it is available but ``iconv()`` is not.
 
+   -  Added compatibility layers for PHP's `Multibyte string <http://php.net/mbstring>`_ (limited support) and `Password Hashing <http://php.net/password>` extensions.
    -  Removed ``CI_CORE`` boolean constant from *CodeIgniter.php* (no longer Reactor and Core versions).
    -  Log Library will now try to create the **log_path** directory if it doesn't exist.
    -  Added support for HTTP-Only cookies with new config option *cookie_httponly* (default FALSE).