soledue Posted May 2, 2012 Share Posted May 2, 2012 how to marked the cookies with the "secure" attribute with apache + openssl? Link to comment Share on other sites More sharing options...
Administrators Farshad Mohajeri Posted May 2, 2012 Administrators Share Posted May 2, 2012 I never heard of secure cookies. Can you send a link regarding it? Link to comment Share on other sites More sharing options...
soledue Posted May 2, 2012 Author Share Posted May 2, 2012 IIS 4.0 and 5.0 Fix Information: http://support.microsoft.com/default.aspx?scid=kb;en-us;274149 Remediation for IIS 6.x: http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/0d49cbc8-10e1-4fa8-ba61- c34e524a3ae6.mspx?mfr=true http://msdn2.microsoft.com/en-us/library/ms998310.aspx Require SSL for an Authentication Cookie (IIS 7): http://technet.microsoft.com/en-us/library/cc771633(WS.10).aspx AnonymousIdentificationSection Class [iIS 7]: http://msdn.microsoft.com/en-us/library/ms689482.aspx Use the following links to remediate this issue on an Apache server: http://search.cpan.org/~jkrasnoo/ApacheCookieEncrypted-0.03/Encrypted.pm http://hc.apache.org/httpclient-3.x/apidocs/org/apache/commons/httpclient/class-use/Cookie.html I never heard of secure cookies. Can you send a link regarding it? Link to comment Share on other sites More sharing options...
soledue Posted May 3, 2012 Author Share Posted May 3, 2012 Encrypt the contents of the header using encryption agreed upon between server administration and the clients. Or, more simply, you may encrypt server-browser exchanges with the SSL security switch in the cookie header. This feature, the SECURE attribute, allows you to limit the cookies' use to a secure channel (such as SSL). To enable this feature, set SECURE to TRUE. You can go a step further by installing an SSL certificate on your Apache server. Then your cookie exchanges will be SSL-encrypted. Link to comment Share on other sites More sharing options...
soledue Posted May 3, 2012 Author Share Posted May 3, 2012 In other words I need mark uni_gui_session_id with Secure attribute like this: Set-Cookie: LSID=DQAAAK…Eaem_vYg; Domain=docs.foo.com; Path=/accounts; Expires=Wed, 13-Jan-2021 22:23:01 GMT; Secure; HttpOnly is possible? Link to comment Share on other sites More sharing options...
Administrators Farshad Mohajeri Posted May 3, 2012 Administrators Share Posted May 3, 2012 I'll look at the issue. Link to comment Share on other sites More sharing options...
soledue Posted May 3, 2012 Author Share Posted May 3, 2012 in unit ExtUtils exist a function with a secure attribute: function TExtUtilCookiesSingleton.SetJS(Name, Value: String; Expires: TExtObject = nil; Path: String = ''; Domain: String = ''; Secure: Boolean =false): TExtFunction; I'll look at the issue. Link to comment Share on other sites More sharing options...
Administrators Farshad Mohajeri Posted May 3, 2012 Administrators Share Posted May 3, 2012 TUniGUICookies.SetCookie() eveloded into: procedure TUniGUICookies.SetCookie(const ACookieName, AValue: string; AExpires: TDateTime=0.0; ASecure: Boolean=False; AHTTPOnly:Boolean=False; const APath:string='/' ); I haven't tested it though. This will be available in next build. Link to comment Share on other sites More sharing options...
soledue Posted May 4, 2012 Author Share Posted May 4, 2012 Thank you very much would be great if I could set secure attribute also to the session_ id cookie TUniGUICookies.SetCookie() eveloded into: procedure TUniGUICookies.SetCookie(const ACookieName, AValue: string; AExpires: TDateTime=0.0; ASecure: Boolean=False; AHTTPOnly:Boolean=False; const APath:string='/' ); I haven't tested it though. This will be available in next build. Link to comment Share on other sites More sharing options...
Administrators Farshad Mohajeri Posted May 4, 2012 Administrators Share Posted May 4, 2012 Thank you very much would be great if I could set secure attribute also to the session_ id cookie Why is it needed? Link to comment Share on other sites More sharing options...
soledue Posted May 4, 2012 Author Share Posted May 4, 2012 you know that something almost absurd, but I'm making as the application is for a bank and must meet certain safety criteria Why is it needed? Link to comment Share on other sites More sharing options...
Administrators Farshad Mohajeri Posted May 4, 2012 Administrators Share Posted May 4, 2012 session_id is only optional and not used internally to track session. It has no meaning for app. unigui doesn't track sessions by cookies. Link to comment Share on other sites More sharing options...
Recommended Posts
Please sign in to comment
You will be able to leave a comment after signing in
Sign In Now