Fixed insecure session cookie initialization (#1656)

getgrav · Sep 28, 2017 · a861d57 · a861d57
1 parent a4ab5d9
commit a861d57
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/system/src/Grav/Common/Session.php b/system/src/Grav/Common/Session.php
@@ -83,6 +83,8 @@ public function init()
               $session_name .= '-admin';
             }
             $this->setName($session_name);
+            ini_set('session.cookie_secure', $secure);
+            ini_set('session.cookie_httponly', $httponly);
             $this->start();
             setcookie(session_name(), session_id(), $session_timeout ? time() + $session_timeout : 0, $session_path, $domain, $secure, $httponly);
         }