View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0005446 | OXID eShop (all versions) | 4.02. Session handling | public | 2013-09-30 14:13 | 2018-03-02 15:50 |
| Reporter | henrik.steffen | Assigned To | |||
| Priority | normal | Severity | feature | Reproducibility | always |
| Status | closed | Resolution | won't fix | ||
| Product Version | 4.7.8 / 5.0.8 | ||||
| Summary | 0005446: Advanced security for session-cookies | ||||
| Description | Security audits require that the "secure-flag" of cookies should always be set. This would imply, the whole shop needs to be run on https:// - which is not viable. Instead, the preferred solution would be to have two different cookies: One just for the http-area of the web-shop, and another one for the https-area (using the httpOnly and secure flags) | ||||
| Tags | Cookies, HTTPS, Security | ||||
| Theme | All | ||||
| Browser | All | ||||
| PHP Version | Not defined | ||||
| Database Version | Not defined | ||||
|
|
waiting for the PO decision. |
|
|
Acknowledged |
|
|
A related pull request was merged: https://github.com/OXID-eSales/oxideshop_ce/pull/360 if the shop is configured to be https only then cookies will have secure flag on And security audits should pass. For security reasons it is not longer suggested to support http/https mix. So the whole shop must always run with https to be secure. I guess there is no more need to support secure flagged cookies in mixed mode - but if you like to do so be aware of problems we had with that in past like https://bugs.oxid-esales.com/view.php?id=2946. So i think this ticket can be closed. |
