[HTTP-Headers] Cookie – Secure flag 指南

Intro

Wikipedia – HTTP cookie – Secure and HttpOnly

Secure flag 旨在要求將cookie加密,使瀏覽器僅能通過安全/加密連接(HTTPS)使用cookie。

另外經常被一起討論的還有 HttpOnly Flag: [[HTTP-Headers] Cookie – HttpOnly flag 指南


實作於程式語言

PHP

Option 1: 實作於 Application 層級

<?php
ini_set('session.cookie_secure', 1);
session_start();
?>

一般知名 PHP framework 會提供 Secure flag 的 config,但基於兼容性預設可能都是關閉

Option 2: 實作於語言設定層級

PHP_INI_ALL:

php_value session.cookie_secure 1

實作於 Web Server

Nginx

Option 1: add_header

設定於 nginx.conf 檔案內 http block 中:

add_header Set-Cookie "Path=/; HttpOnly; Secure";

Option 1: proxy_cookie_path

設定於 ssl.conf, default.confserver > location 中:

proxy_cookie_path / "/; HTTPOnly; Secure";

Leave a Reply

Your email address will not be published. Required fields are marked *