Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Currently session_api_get_sid() calls setcookie() without setting the Secure and HTTPOnly parameters, and the only way to get this cookie to be secure and httponly is to hack the module... do let me know if there's another way ;-)
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | set_session_api_session-2538378-1.patch | 607 bytes | manuel garcia |
Comments
Comment #1
manuel garcia commentedComment #2
manuel garcia commentedComment #3
a.ross commentedI would prefer these to be configurable in the module configuration form, instead of using PHP's session config parameters.