Add the Secure flag to cookies on Apache
Why it matters
A cookie without Secure is also sent over plain http, where anyone on the network can read it and, for a session cookie, take over the visitor's account. Secure keeps it to HTTPS connections.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Stage 1: make sure the whole site works over https and http redirects to https. Fixing the flag where the cookie is created (application or php.ini) is better than rewriting it in Apache.
- Stage 2: if the application cannot be changed, the mod_headers lines below append Secure to every Set-Cookie that lacks it. Cookies can sit in either response table, so both lines are needed. Reload and test logging in.
apache
Header onsuccess edit Set-Cookie "(?i)^((?!.*;\s*secure\b).*)$" "$1; Secure" Header always edit Set-Cookie "(?i)^((?!.*;\s*secure\b).*)$" "$1; Secure"
Related
Scan your domain to see whether this applies to you.