Issue #3092: change default of HTTPOnly to 1

Do not pass unneeded 'HTTPOnly => 1' to SetCookie()
RotherOSS · Mar 3, 2024 · bbf4572 · bbf4572
1 parent be7d774
commit bbf4572
Show file tree

Hide file tree

Showing 7 changed files with 57 additions and 74 deletions.
diff --git a/Kernel/Modules/AdminCustomerUser.pm b/Kernel/Modules/AdminCustomerUser.pm
@@ -168,13 +168,12 @@ sub Run {
             SessionName => $ConfigObject->Get('SessionName'),
         );
         $LayoutObject->SetCookie(
-            Key      => 'SessionIDCookie',
-            Name     => $SessionName,
-            Value    => $NewSessionID,
-            Expires  => $Expires,
-            Path     => $ConfigObject->Get('ScriptAlias'),
-            Secure   => $CookieSecureAttribute,
-            HTTPOnly => 1,
+            Key     => 'SessionIDCookie',
+            Name    => $SessionName,
+            Value   => $NewSessionID,
+            Expires => $Expires,
+            Path    => $ConfigObject->Get('ScriptAlias'),
+            Secure  => $CookieSecureAttribute,
         );
 
         # log event

diff --git a/Kernel/Modules/AdminUser.pm b/Kernel/Modules/AdminUser.pm
@@ -131,7 +131,6 @@ sub Run {
             Expires      => $Expires,
             Path         => $ConfigObject->Get('ScriptAlias'),
             Secure       => $CookieSecureAttribute,
-            HTTPOnly     => 1,
         );
 
         $Kernel::OM->ObjectsDiscard( Objects => ['Kernel::Output::HTML::Layout'] );

diff --git a/Kernel/Output/HTML/Layout.pm b/Kernel/Output/HTML/Layout.pm
@@ -740,12 +740,12 @@ sub Login {
 
         # set a cookie tentatively for checking cookie support
         $Self->SetCookie(
-            Key      => 'OTOBOBrowserHasCookie',
-            Value    => 1,
-            Expires  => $Expires,
-            Path     => $ConfigObject->Get('ScriptAlias'),
-            Secure   => $CookieSecureAttribute,
-            HTTPOnly => 1,
+            Key     => 'OTOBOBrowserHasCookie',
+            Name    => 'OTOBOBrowserHasCookie',
+            Value   => 1,
+            Expires => $Expires,
+            Path    => $ConfigObject->Get('ScriptAlias'),
+            Secure  => $CookieSecureAttribute,
         );
     }
 
@@ -4073,13 +4073,12 @@ sub CustomerLogin {
 
         # set a cookie tentatively for checking cookie support
         $Self->SetCookie(
-            Key      => 'OTOBOBrowserHasCookie',
-            Name     => 'OTOBOBrowserHasCookie',
-            Value    => 1,
-            Expires  => $Expires,
-            Path     => $ConfigObject->Get('ScriptAlias'),
-            Secure   => $CookieSecureAttribute,
-            HTTPOnly => 1,
+            Key     => 'OTOBOBrowserHasCookie',
+            Name    => 'OTOBOBrowserHasCookie',
+            Value   => 1,
+            Expires => $Expires,
+            Path    => $ConfigObject->Get('ScriptAlias'),
+            Secure  => $CookieSecureAttribute,
         );
     }
 
@@ -6664,14 +6663,14 @@ sub UserInitialsGet {
 Declare a cookie that should be sent out via the Set-Cookie HTTP header.
 
     $ResponseObject->SetCookie(
+        RegisterInOM => 1,           # 0|1, optional, default 0, whether $Kernel::OM->ObjectParamAdd() should be called
         Key          => 'ID',        # name, determines order in which cookies are set when they have the same name
         Name         => 'Name',      # optional, name of the cookie, the default is the value of 'Key'
         Value        => 123456,      # value
         Expires      => '+3660s',    # expires
         Path         => 'otobo/',    # path optional, only allow cookie for given path, '/' will be prepended
         Secure       => 1,           # secure optional, set secure attribute to disable cookie on HTTP (HTTPS only), default is off
-        HTTPOnly     => 1,           # httponly optional, sets httponly attribute of cookie to prevent access via JavaScript, default is off
-        RegisterInOM => 1,           # 0|1, optional, default 0, whether $Kernel::OM->ObjectParamAdd() should be called
+        HTTPOnly     => 1,           # 1|'', optional, the default is 1, sets httponly attribute of cookie to prevent access via JavaScript
     );
 
 The attribute 'samesite' is set based on the SysConfig setting B<SessionSameSite>. The default is 'lax'.
@@ -6713,7 +6712,7 @@ sub SetCookie {
         expires  => $Param{Expires},
         secure   => $Param{Secure} || '',
         samesite => $SameSite,
-        httponly => $Param{HTTPOnly} || '',
+        httponly => $Param{HTTPOnly} // 1,
         path     => '/' . ( $Param{Path} // '' ),
     );
 

diff --git a/Kernel/System/Auth/OpenIDConnect.pm b/Kernel/System/Auth/OpenIDConnect.pm
@@ -376,13 +376,12 @@ sub PreAuth {
 
     # store the RandomString as a CSRF cookie
     $LayoutObject->SetCookie(
-        Key      => 'OIDCCSRF',
-        Name     => 'OIDCCSRF',
-        Value    => $RandomString,
-        Path     => $ConfigObject->Get('ScriptAlias'),
-        Secure   => $ConfigObject->Get('HttpType') eq 'https' ? 1 : undef,
-        HTTPOnly => 1,
-        Expires  => '+' . $TTL . 's',
+        Key     => 'OIDCCSRF',
+        Name    => 'OIDCCSRF',
+        Value   => $RandomString,
+        Path    => $ConfigObject->Get('ScriptAlias'),
+        Secure  => $ConfigObject->Get('HttpType') eq 'https' ? 1 : undef,
+        Expires => '+' . $TTL . 's',
     );
 
     # add a nonce if configured

diff --git a/Kernel/System/CustomerAuth/OpenIDConnect.pm b/Kernel/System/CustomerAuth/OpenIDConnect.pm
@@ -287,13 +287,12 @@ sub PreAuth {
 
     # store the RandomString as a CSRF cookie
     $LayoutObject->SetCookie(
-        Key      => 'OIDCCSRF',
-        Name     => 'OIDCCSRF',
-        Value    => $RandomString,
-        Path     => $ConfigObject->Get('ScriptAlias'),
-        Secure   => $ConfigObject->Get('HttpType') eq 'https' ? 1 : undef,
-        HTTPOnly => 1,
-        Expires  => '+' . $TTL . 's',
+        Key     => 'OIDCCSRF',
+        Name    => 'OIDCCSRF',
+        Value   => $RandomString,
+        Path    => $ConfigObject->Get('ScriptAlias'),
+        Secure  => $ConfigObject->Get('HttpType') eq 'https' ? 1 : undef,
+        Expires => '+' . $TTL . 's',
     );
 
     # add a nonce if configured

diff --git a/Kernel/System/Web/InterfaceAgent.pm b/Kernel/System/Web/InterfaceAgent.pm
@@ -329,12 +329,12 @@ sub Content {
             # tentatively set an useless cookie, for checking cookie support
             my $LayoutObject = $Kernel::OM->Get('Kernel::Output::HTML::Layout');
             $LayoutObject->SetCookie(
-                Key      => 'OTOBOBrowserHasCookie',
-                Value    => 1,
-                Expires  => $Expires,
-                Path     => $ConfigObject->Get('ScriptAlias'),
-                Secure   => $CookieSecureAttribute,
-                HTTPOnly => 1,
+                Key     => 'OTOBOBrowserHasCookie',
+                Name    => 'OTOBOBrowserHasCookie',
+                Value   => 1,
+                Expires => $Expires,
+                Path    => $ConfigObject->Get('ScriptAlias'),
+                Secure  => $CookieSecureAttribute,
             );
 
             # redirect to alternate login
@@ -524,7 +524,6 @@ sub Content {
             Expires      => $Expires,
             Path         => $ConfigObject->Get('ScriptAlias'),
             Secure       => $CookieSecureAttribute,
-            HTTPOnly     => 1,
         );
         Kernel::Output::HTML::Layout->SetCookie(
             RegisterInOM => 1,
@@ -534,7 +533,6 @@ sub Content {
             Expires      => '-1y',
             Path         => $ConfigObject->Get('ScriptAlias'),
             Secure       => $CookieSecureAttribute,
-            HTTPOnly     => 1,
         );
 
         # Check if Chat is active
@@ -643,7 +641,6 @@ sub Content {
             Expires      => '-1y',
             Path         => $ConfigObject->Get('ScriptAlias'),
             Secure       => $CookieSecureAttribute,
-            HTTPOnly     => 1,
         );
 
         $Kernel::OM->ObjectsDiscard( Objects => ['Kernel::Output::HTML::Layout'] );
@@ -892,12 +889,12 @@ sub Content {
 
                     # set a cookie tentatively for checking cookie support
                     $LayoutObject->SetCookie(
-                        Key      => 'OTOBOBrowserHasCookie',
-                        Value    => 1,
-                        Expires  => $Expires,
-                        Path     => $ConfigObject->Get('ScriptAlias'),
-                        Secure   => $CookieSecureAttribute,
-                        HTTPOnly => 1,
+                        Key     => 'OTOBOBrowserHasCookie',
+                        Name    => 'OTOBOBrowserHasCookie',
+                        Value   => 1,
+                        Expires => $Expires,
+                        Path    => $ConfigObject->Get('ScriptAlias'),
+                        Secure  => $CookieSecureAttribute,
                     );
                 }
 
@@ -951,7 +948,6 @@ sub Content {
                 Expires      => '-1y',
                 Path         => $ConfigObject->Get('ScriptAlias'),
                 Secure       => $CookieSecureAttribute,
-                HTTPOnly     => 1,
             );
 
             # if the wrong scheme is used, delete also the "other" cookie - issue #251
@@ -973,7 +969,6 @@ sub Content {
                     Expires      => '-1y',
                     Path         => $ConfigObject->Get('ScriptAlias'),
                     Secure       => '',
-                    HTTPOnly     => 1,
                 );
                 Kernel::Output::HTML::Layout->SetCookie(
                     RegisterInOM => 1,
@@ -983,7 +978,6 @@ sub Content {
                     Expires      => '-1y',
                     Path         => $ConfigObject->Get('ScriptAlias'),
                     Secure       => 1,
-                    HTTPOnly     => 1,
                 );
             }
 

diff --git a/Kernel/System/Web/InterfaceCustomer.pm b/Kernel/System/Web/InterfaceCustomer.pm
@@ -320,12 +320,12 @@ sub Content {
             # tentatively set an useless cookie, for checking cookie support
             my $LayoutObject = $Kernel::OM->Get('Kernel::Output::HTML::Layout');
             $LayoutObject->SetCookie(
-                Key      => 'OTOBOBrowserHasCookie',
-                Value    => 1,
-                Expires  => $Expires,
-                Path     => $ConfigObject->Get('ScriptAlias'),
-                Secure   => $CookieSecureAttribute,
-                HTTPOnly => 1,
+                Key     => 'OTOBOBrowserHasCookie',
+                Name    => 'OTOBOBrowserHasCookie',
+                Value   => 1,
+                Expires => $Expires,
+                Path    => $ConfigObject->Get('ScriptAlias'),
+                Secure  => $CookieSecureAttribute,
             );
 
             # redirect to alternate login
@@ -518,7 +518,6 @@ sub Content {
             Expires      => $Expires,
             Path         => $ConfigObject->Get('ScriptAlias'),
             Secure       => $CookieSecureAttribute,
-            HTTPOnly     => 1,
         );
 
         # delete the OTOBOBrowserHasCookie cookie
@@ -530,7 +529,6 @@ sub Content {
             Expires      => '-1y',
             Path         => $ConfigObject->Get('ScriptAlias'),
             Secure       => $CookieSecureAttribute,
-            HTTPOnly     => 1,
         );
 
         # redirect with new session id and old params
@@ -600,7 +598,6 @@ sub Content {
             Expires      => '-1y',
             Path         => $ConfigObject->Get('ScriptAlias'),
             Secure       => $CookieSecureAttribute,
-            HTTPOnly     => 1,
         );
 
         $Kernel::OM->ObjectsDiscard( Objects => ['Kernel::Output::HTML::Layout'] );
@@ -1048,12 +1045,12 @@ sub Content {
 
                     # set a cookie tentatively for checking cookie support
                     $LayoutObject->SetCookie(
-                        Key      => 'OTOBOBrowserHasCookie',
-                        Value    => 1,
-                        Expires  => $Expires,
-                        Path     => $ConfigObject->Get('ScriptAlias'),
-                        Secure   => $CookieSecureAttribute,
-                        HTTPOnly => 1,
+                        Key     => 'OTOBOBrowserHasCookie',
+                        Name    => 'OTOBOBrowserHasCookie',
+                        Value   => 1,
+                        Expires => $Expires,
+                        Path    => $ConfigObject->Get('ScriptAlias'),
+                        Secure  => $CookieSecureAttribute,
                     );
                 }
 
@@ -1107,7 +1104,6 @@ sub Content {
                 Expires      => '-1y',
                 Path         => $ConfigObject->Get('ScriptAlias'),
                 Secure       => $CookieSecureAttribute,
-                HTTPOnly     => 1,
             );
 
             # if the wrong scheme is used, delete also the "other" cookie - issue #251
@@ -1129,7 +1125,6 @@ sub Content {
                     Expires      => '-1y',
                     Path         => $ConfigObject->Get('ScriptAlias'),
                     Secure       => '',
-                    HTTPOnly     => 1,
                 );
 
                 # delete the OTOBO session cookie
@@ -1141,7 +1136,6 @@ sub Content {
                     Expires      => '-1y',
                     Path         => $ConfigObject->Get('ScriptAlias'),
                     Secure       => 1,
-                    HTTPOnly     => 1,
                 );
             }