Make session cookies HttpOnly on nginx
Why it matters
Scripts on the page can read a session cookie without HttpOnly, so any cross-site scripting bug lets an attacker steal the login. HttpOnly hides the cookie from JavaScript while the browser still sends it with requests.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Stage 1: check that no front-end code needs to read the cookie.
- Stage 2: if nginx proxies to the application, add HttpOnly to that one cookie as below (nginx 1.19.3 or later), replacing session_cookie_name with the name from the finding. Cookies from PHP-FPM are not covered; use php.ini.
- nginx applies only the first proxy_cookie_flags line that matches a cookie. Give each named cookie one line with all its flags, before any catch-all ~ line. samesite=lax replaces a SameSite value the cookie already has, so write the value it should end up with (samesite=strict to keep Strict). Run sudo nginx -t, reload and test logging in.
nginx
# named cookies first, each with all of its flags proxy_cookie_flags session_cookie_name secure httponly samesite=lax; # a catch-all line, if you have one, goes after every named line # proxy_cookie_flags ~ secure;
Related
Scan your domain to see whether this applies to you.