This is another complaint we get from customers running security scans against our app.

Is there a way to ensure that cookies have the secure flag set by default? Or do I just need to go through the source looking for AddCookie instances? I'll admit that I haven't paid much attention to WC cookie creation - mostly relying on the framework handle it.

--stein

The secure flag is not set by default but the options to do so are on the various methods. The default generated projects use secure Session cookies - and you can manually set this in one place by adding the secure parameter to the InitSession() call.

For the explicit AddCookie() calls you have you go through and explicitly add the secure header.

Can't really change the default because that can potentially affect behavior of existing applications.

+++ Rick ---

Since I need to revisit all the AddCookie instances in my code, I thought I'd refactor everything to use wwCookie as recommended in the docs.

I want something equivalent to this (but with the secure flag set):

    loHeader = CREATE("wwHTTPHeader")  
    loHeader.DefaultHeader()
    loHeader.AddCookie("WWSESSIONID",cSessionID)
    Response.ContentTypeHeader(loHeader)
    RELEASE loHeader

Would this work?

    loCookie = CREATEOBJECT("wwCookie")
    loCookie.CookieName = "WWSESSIONID"
    loCookie.Value = cSessionID
    loCookie.Secure = .T.
    Response.AddCookie(loCookie) 

--sg

Yes that code is the way to do it. I would create function or method somewhere for setting cookies in one place so you don't have to write this code each time.

FUNCTION GetApplicationCookie()
   LOCAL loCookie
   loCookie = CREATEOBJECT("wwCookie")
   loCookie.CookieName = "WWSESSIONID"
   loCookie.Value = cSessionID
   loCookie.HttpOnly = .T.
   loCookie.Secure = .T.
   RETURN loCookie
ENDFUNC

Note that if you set the cookie to secure you have to use HTTPS - this might affect your development setup which now also has to run as https in order to have the cookie work. If that's the case you might want to selectively add a configuration flag around the settings to determine whether the cookie should be secure.

Or - use HTTPS locally - IIS Express and the Web Connection Web Server both can run HTTPS locally, which is not a bad idea.

+++ Rick ---

Thanks for the suggestions and the heads-up on setting the secure flag when running the app locally.

--sg