search

jpatokal / openflights

Website for storing flight information, rendering paths on a zoomable world map and calculating statistics, with plenty of free airline, airport and route data.
http://openflights.org
GNU Affero General Public License v3.0
1.37k stars 387 forks source link

Session cookie issues #1436

Open reedy opened 10 months ago

reedy commented 10 months ago

The PHP session cookie should have the secure flag and possibly the HttpOnly flag too

https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes.html https://owasp.org/www-community/HttpOnly

We can do this by slightly changing the session_start() call

https://www.php.net/manual/en/function.session-start.php https://www.php.net/manual/en/session.configuration.php

session_start(['cookie_secure' => true, 'cookie_httponly' => true]);

We might want to set a lifetime too...

session_start(['cookie_lifetime' => 43200, 'cookie_secure' => true, 'cookie_httponly' => true]);

Might make sessions a bit more.. reliable?