Fix #397 - use httpOnly in cookies

lochmueller · Aug 22, 2023 · 08e6437 · 08e6437
1 parent e19d853
commit 08e6437
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/Classes/Service/ClientService.php b/Classes/Service/ClientService.php
@@ -57,12 +57,14 @@ public function runSingleRequest(string $url): int
  protected function getCallableClient(string $domain): Client
  {
  $jar = GeneralUtility::makeInstance(CookieJar::class);
+ /** @var SetCookie $cookie */
  $cookie = GeneralUtility::makeInstance(SetCookie::class);
  $cookie->setName(CookieService::FE_COOKIE_NAME);
  $cookie->setValue('1');
  $cookie->setPath('/');
  $cookie->setExpires((new DateTimeService())->getCurrentTime() + 3600);
  $cookie->setDomain($domain);
+ $cookie->setHttpOnly(true);
  $jar->setCookie($cookie);
  $options = [
  'cookies' => $jar,

diff --git a/Classes/Service/CookieService.php b/Classes/Service/CookieService.php
@@ -31,7 +31,7 @@ public function setCookie(int $lifetime): void
  if ($lifetime !== self::SESSION_LIFETIME) {
  $lifetime += $this->dateTimeService->getCurrentTime();
  }
- setcookie(self::FE_COOKIE_NAME, 'typo_user_logged_in', $lifetime, '/', $this->getCookieDomain(), GeneralUtility::getIndpEnv('TYPO3_SSL'));
+ setcookie(self::FE_COOKIE_NAME, 'typo_user_logged_in', $lifetime, '/', $this->getCookieDomain(), GeneralUtility::getIndpEnv('TYPO3_SSL'), true);
  }
 
  /**