All of our store setups are 100% https only and have been since day 1 with XC5. On the server side, this is via permanent SEO-safe 301 redirects from HTTP to HTTPS but also, the XC5
https://*.*/admin.php?target=https_settings page and
Redirect customers to HTTPS flag is set to
YES. All of this is fine, it works and there's no issues here. The small issue is the XC5 cookie setting...
If the
Redirect customers to HTTPS flag is set to
YES by Admin, then by default, the XC5 cookie
should include a
Secure flag designed to protect cookies against their accidental transmission over HTTP. Okay, it's technically impossible in our case, especially with HSTS in place too...but the lack of the
Secure flag in the cookie is brought up as an error, on every single test site you may care to use. This is correct as it's contradictory in terms of setup flags.
This doesn't impede trading, but as far as we can see, this hasn't already been noticed / tested / added previously by XC
so technically it's another very small bug, but moving forward positively, why can't this simply be added in the next XC5 upgrade? Especially as all other cookie directives have been comfortably met by XC5 already and have been for some time now (see below)
Quote:
Secure: All cookies must be set with the Secure flag, indicating that they should only be sent over HTTPS
HttpOnly: Cookies that don't require access from JavaScript should be set with the HttpOnly flag
Expiration: Cookies should expire as soon as is necessary: session identifiers in particular should expire quickly
Expires: Sets an absolute expiration date for a given cookie
Max-Age: Sets a relative expiration date for a given cookie (not supported by IE <
Domain: Cookies should only be set with this if they need to be accessible on other domains, and should be set to the most restrictive domain possible
Path: Cookies should be set to the most restrictive path possible, but for most applications this will be set to the root directory
|