[#43882] - [5.x] Fix `secure` flag for session cookies
- Fixed in Code Base
- 5 Aug 2024
- Medium
- Build: 5.1-dev
- # 43882
- Diff
- SniperSister:fix/5x-secure-flag
User tests: Successful: Unsuccessful:
Summary of Changes
The rework of the session management introduced in 5.x broke the code that sets the secure flag for the session cookie on sites with enforced HTTPS. The $options variable, containing the config isn't passed to the storage anymore, resulting in the absence of the flag regardless of the configuration state:
84776fb#diff-bc8698a8418bcc017e622d13e0d460e94f502f09ae0f9c50cb6cd9f7ede73cb0L90
Testing Instructions
Enable "force SSL" on a 5.x site, inspect the session cookie using your developer tools. Verify that the flag is absent. Apply the patch and delete the cookie in your browser. Refresh.
Actual result BEFORE applying this Pull Request
No secure flag
Expected result AFTER applying this Pull Request
secure flag is set as expected
Link to documentations
Please select:
-
Documentation link for docs.joomla.org:
-
No documentation changes for docs.joomla.org needed
-
Pull Request link for manual.joomla.org:
-
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Libraries |
| Labels |
Added:
PR-5.1-dev
|
||
I have tested this item ✅ successfully on a459e59
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/43882.
I have tested this item ✅ successfully on a459e59
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/43882.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/43882.
| Labels |
Added:
RTC
|
||
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2024-08-05 13:34:32 |
| Closed_By | ⇒ | wilsonge | |
| Labels |
Added:
Release Blocker
|
||
My bad! Must have had something in mind at some point - but no clue what 3 years later :(
I've labeled the PR as release blocker because it's security relevant