X-Cart forums

[Triple A Racing]

All of our store setups are 100% https only and have been since day 1 with XC5. On the server side, this is via permanent SEO-safe 301 redirects from HTTP to HTTPS but also, the XC5 https://*.*/admin.php?target=https_settings page and Redirect customers to HTTPS flag is set to YES. All of this is fine, it works and there's no issues here. The small issue is the XC5 cookie setting...

If the Redirect customers to HTTPS flag is set to YES by Admin, then by default, the XC5 cookie should include a Secure flag designed to protect cookies against their accidental transmission over HTTP. Okay, it's technically impossible in our case, especially with HSTS in place too...but the lack of the Secure flag in the cookie is brought up as an error, on every single test site you may care to use. This is correct as it's contradictory in terms of setup flags.

This doesn't impede trading, but as far as we can see, this hasn't already been noticed / tested / added previously by XC so technically it's another very small bug, but moving forward positively, why can't this simply be added in the next XC5 upgrade? Especially as all other cookie directives have been comfortably met by XC5 already and have been for some time now (see below)

Secure: All cookies must be set with the Secure flag, indicating that they should only be sent over HTTPS

HttpOnly: Cookies that don't require access from JavaScript should be set with the HttpOnly flag

Expiration: Cookies should expire as soon as is necessary: session identifiers in particular should expire quickly

Expires: Sets an absolute expiration date for a given cookie

Max-Age: Sets a relative expiration date for a given cookie (not supported by IE <

Domain: Cookies should only be set with this if they need to be accessible on other domains, and should be set to the most restrictive domain possible

Path: Cookies should be set to the most restrictive path possible, but for most applications this will be set to the root directory

[qualiteam]

I've forwarded this information to the XC5 dev team.

[Triple A Racing]

Originally Posted by qualiteam

I've forwarded this information to the XC5 dev team.

Pleased to say the bug fix ticket that we raised, advised that this would be fixed in XC 5.3.5.* and it has
We've checked it, double checked it, independently tested it and it's all good.