From eda4426085967988c5266f94005723e6fd5d86ad Mon Sep 17 00:00:00 2001 From: Martin Nowack Date: Thu, 1 Aug 2013 14:57:08 +0200 Subject: [PATCH] Request secure cookie transmission for HTTPS If cookies are not marked as secure, they can be sent back by the client on unencrypted channels, disclosing information. With this fix, clients are requested to send cookies back on a secure channel in case HTTPS is used. --- src/HTTPSock.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/HTTPSock.cpp b/src/HTTPSock.cpp index 984d9ccf..c0a2a535 100644 --- a/src/HTTPSock.cpp +++ b/src/HTTPSock.cpp @@ -645,7 +645,7 @@ bool CHTTPSock::PrintHeader(off_t uContentLength, const CString& sContentType, u MCString::iterator it; for (it = m_msResponseCookies.begin(); it != m_msResponseCookies.end(); ++it) { - Write("Set-Cookie: " + it->first.Escape_n(CString::EURL) + "=" + it->second.Escape_n(CString::EURL) + "; path=/;\r\n"); + Write("Set-Cookie: " + it->first.Escape_n(CString::EURL) + "=" + it->second.Escape_n(CString::EURL) + "; path=/;" + (GetSSL() ? "Secure;" : "") + "\r\n"); } for (it = m_msHeaders.begin(); it != m_msHeaders.end(); ++it) {