The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.I had a request to remove the HttpOnly attribute from a cookie, but that's not supported by default. Looking at the codebase, it seems that by default HttpOnly was set to FALSE in Drupal 7, but now uses the TRUE default set by the Symfony HttpFoundation Cookie constructor.
The ideal resolution would be a configurable option, defaulting to true, on whether to set this value.
A workaround patch has been included which forces the value to false, but a full configurable feature still needs to be written and tested.
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | 3197378-5.patch | 6.85 KB | jeroent |
| #4 | language_cookie-disable_httponly-3197378-4.patch | 2.88 KB | pakmanlh |
| #2 | language_cookie-disable_httponly-3197378-2.patch | 1.03 KB | dieuwe |
Comments
Comment #2
dieuweI haven't got time to work on a fully configurable option, so here is just a patch which will always remove the HttpOnly attribute from the cookie when included.
Comment #3
dieuweComment #4
pakmanlhNice catch @dieuwe! Here you have a patch that allows to config the http_only value following the same way the others settings work. Cheers!
Comment #5
jeroentComment #6
jeroentI updated patch #4 so the default value is TRUE since that is currently the expected value.
+ I added a config schema and test coverage.
Comment #7
jeroentCommitted and pushed to 8.x-1.x. Thanks!