Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Check that all Matomo cookies are set with the Secure flag in the UI #12841

Closed
mattab opened this issue May 7, 2018 · 1 comment
Closed

Check that all Matomo cookies are set with the Secure flag in the UI #12841

mattab opened this issue May 7, 2018 · 1 comment
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github.
Milestone
3.6.0

Comments

@mattab
Copy link
Member

mattab commented May 7, 2018

We got a security report piwik_lang Cookie has problem(s) piwik_lang = language%3Dczo1OiJ6aC10dyI7%3A_%xxxxx; Host = OURSITE; Path = / 1. Cookie does not have secure attribute.

-> Let's check and ensure that all our cookies have the Secure flag, when Matomo is used over HTTPS.
@mattab mattab added the c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. label May 7, 2018
@mattab mattab added this to the 3.6.0 milestone May 7, 2018
@sgiehl sgiehl mentioned this issue Jun 25, 2018
Merged
@diosmosis diosmosis mentioned this issue Jul 31, 2018
Merged
@diosmosis
Copy link
Member

@mattab checked and the lang & (now unused) auth cookie are both secure if HTTPS is used. The tracker cookies aren't, but I think we want them to be applied regardless of protocol. Closing this.

@GreenReaper GreenReaper mentioned this issue Dec 17, 2018
Closed
@tom275 tom275 mentioned this issue Mar 6, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github.
Projects
None yet
Milestone
3.6.0
Development

No branches or pull requests
2 participants
@diosmosis @mattab