<p dir="auto">Hi,</p>
<p dir="auto">Just seeking enlightenment regarding the default values for cookies with Symfony2.</p>
<p dir="auto"><a href="http://symfony.com/doc/current/reference/configuration/framework.html#cookie-httponly" rel="nofollow">http://symfony.com/doc/current/reference/configuration/framework.html#cookie-httponly</a></p>
<p dir="auto">Documentation here states the default value for cookie's created by the framework are for httponly to be set to false.</p>
<p dir="auto">I've personally encountered numerous Symfony2 apps where existing XSS injection vulnerabilities resulting in identify theft could be easily mitigated by changing this value to true. Below is the relevant OWASP documentation:</p>
<p dir="auto"><a href="https://www.owasp.org/index.php/HttpOnly" rel="nofollow">https://www.owasp.org/index.php/HttpOnly</a></p>
<p dir="auto">I can't help but wonder the rationale behind providing less than secure defaults?</p>
<p dir="auto">Cheers</p>
<p dir="auto">Actually, the default value of <code class="notranslate">framework.session.cookie_httponly</code> is <code class="notranslate">false</code>, which allows javascript to read the sessionId.</p>
<p dir="auto">To improve security, I think, we should add a BC Break by inverting this parameter.</p>