note 73818 deleted from function.session-set-cookie-params by mazzanet
| From: | mazzanet@php.net | Date: | Mon, 12 Mar 2007 06:48:03 +0000 |
| Subject: | note 73818 deleted from function.session-set-cookie-params by mazzanet | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-124358@lists.php.net to get a copy of this message | ||
Note Submitter: mbowie at NOSPAM dot buzmo dot com
----
It would seem that session_set_cookie_params will still set a cookie via HTTP, even if the secure
parameter is true.
So even if your site uses HTTPS/SSL to communicate sensitive data, if the initial session cookie was
set by PHP's session module via HTTP, an attacker listening on the wire could easily spoof a
visitor's cookie and gain access to their session.
See: http://bugs.php.net/bug.php?id=40778