@@ -, +, @@ --- C4/Auth.pm | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -635,7 +635,8 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => '', - -expires => '' + -expires => '', + -HttpOnly => 1, ); $loggedin = 1; } @@ -705,7 +706,10 @@ sub checkauth { $userid = undef; } else { - $cookie = $query->cookie( CGISESSID => $session->id ); + $cookie = $query->cookie( + -name => 'CGISESSID', + -value => $session->id, + -HttpOnly => 1); $session->param('lasttime',time()); unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... $flags = haspermission($userid, $flagsrequired); @@ -722,7 +726,10 @@ sub checkauth { my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; my $sessionID = $session->id; C4::Context->_new_userenv($sessionID); - $cookie = $query->cookie( CGISESSID => $sessionID ); + $cookie = $query->cookie( + -name => 'CGISESSID', + -value => $session->id, + -HttpOnly => 1); $userid = $query->param('userid'); if ( ( $cas && $query->param('ticket') ) || $userid @@ -914,7 +921,10 @@ sub checkauth { { # successful login unless ($cookie) { - $cookie = $query->cookie( CGISESSID => '' ); + $cookie = $query->cookie( + -name => 'CGISESSID', + -value => '', + -HttpOnly => 1); } return ( $userid, $cookie, $sessionID, $flags ); } --