HttpOnly cookie
-
Is there a reason why you set the HttpOnly flag to false in the wp_dlm_downloading cookie? General practice is to set HttpOnly=true to avoid XSS vulnerabilities.
In includes/class-dlm-download-handler.php:
setcookie( 'wp_dlm_downloading', $download->id, time()+60, COOKIEPATH, COOKIE_DOMAIN, false );
Viewing 3 replies - 1 through 3 (of 3 total)
Viewing 3 replies - 1 through 3 (of 3 total)
- The topic ‘HttpOnly cookie’ is closed to new replies.