Doc #55002 [Opn->Csd]: setcookie httponly parameter documentation problem

Edit report at https://bugs.php.net/bug.php?id=55002&edit=1 ID: 55002 Updated by: frozenfire@php.net Reported by: fsb at thefsb dot org Summary: setcookie httponly parameter documentation problem -Status: Open +Status: Closed Type: Documentation Problem Package: Documentation problem Operating System: All PHP Version: 5.3.6 -Assigned To: +Assigned To: frozenfire Block user comment: N Private report: N New Comment: This bug has been fixed in the documentation's XML sources. Since the online and downloadable versions of the documentation need some time to get updated, we would like to ask you to be a bit patient. Thank you for the report, and for helping us make our documentation better. Previous Comments: ------------------------------------------------------------------------ [2011-07-01 19:05:39] frozenfire@php.net Automatic comment from SVN on behalf of frozenfire Revision: http://svn.php.net/viewvc/?view=revision&revision=312787 Log: Added weasel words to httponly parameter, as per bug #55002. ------------------------------------------------------------------------ [2011-06-06 19:59:29] fsb at thefsb dot org Description: ------------ --- From manual page: http://www.php.net/function.setcookie#Parameters --- In the description of @param httponly, the sentence "This setting can effectively help to reduce identity theft through XSS attacks (although it is not supported by all browsers)," is at best controversial and perhaps even misleading. It has been widely discussed so I let you research it with Google. --- Suggested remedy --- I would delete the sentence altogether and replace it with a simple reference to RFC 6265 http://www.rfc-editor.org/rfc/rfc6265.txt This keeps you out of the argument. Alternatively, use weasel words. Try: "This setting may help to reduce identity..." ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=55002&edit=1