Question posted in
Some documentation to get you started can be found here.

Set-Cookie is stopping me from logging into WordPress – Apache

I am running WordPress 5.3.2 on Apache/2.4.29 (Ubuntu) 18.04 on a Digital Ocean droplet.

My client requested the following:

All cookies transferred over an encrypted session, in particular session cookies, should be marked as ‘Secure’ and all session information should be transmitted over HTTPS.

The HttpOnly flag should also be set within the cookie

So, I defined the following in the virtual host:

Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=Strict

I then tested the header response and could see my Set-Cookie defined.

The problem is, I now can’t login to WordPress. WordPress says:

ERROR: cookies are blocked or not supported by your browser. You must
enable cookies to use WordPress.

What am I doing wrong?

Tags:

2

Answers


  1. 0

    Strict is probably more restrictive than you want, as this will prevent cookies from being sent on initial cross-site navigations, e.g. if I emailed you a link to a page on your blog, when you first followed that link, the SameSite=Strict cookies would not be sent and it might appear as if you were not logged in.

    SameSite=Lax is a better default here. Then I would explicitly look at setting SameSite=Strict or SameSite=None on individual cookies where you know the level of access required.

    The HttpOnly attribute is also blanket preventing all of your server-side set cookies from being read by JavaScript. You may well have functionality on your page that requires this.

    Finally, a blanket approach here is probably overkill – as it looks as if you will be appending this snippet to every outgoing cookie header, even the ones that already include those attributes. This is likely to cause some unpredictable behaviour. I would either do this on a specific allow-list basis by checking for explicit cookie names or I would alter the regex to only set this if those attributes are missing.

    Login or Signup to reply.
  2. 0

    A late answer. But if it helps someone:

    Put these values in php.ini

    session.cookie_httponly = 1
session.cookie_secure = 1

    Of course you should have a valid https certificate.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search