Update:
Thanks to Dom Stubbs, I have an extension to accomplish this now.  It is up on devot-ee and also up on GitHub.  Thanks Dom!

The Original Question

I am nearly through a security review of a new EE2 version of an existing EE1 site that I hope to launch soon.  One of the final issues remaining is to make the cookies HttpOnly.  I've tried doing that through this line in the apache config:

Header edit Set-Cookie "(?i)^((?:(?!;\s?HttpOnly).)+)$" "$1; HttpOnly"


Using the dev tools in my browser I can see that it does indeed append HttpOnly to the Set-Cookie headers, but the issue then becomes that I cannot log in.  When I asked Ellislab they tell me that the cookies should not be being dealt with in javascript, which was what I expected the issue might be.

ExpressionEngine does not seem to use the session libraries from codeignitor, if it did I could set a config variable to turn httponly on, but it looks like the session handling code is in the expressionengine side of things.

The real question that I need answered is how can I make HttpOnly cookies work, but I guess that breaks down into some potential subquestions:


Am I missing an addon that would allow me to do this without a lot more heartache?Is there something wrong with my apache approach?  Are you able to log in if you enable that in Apache, log out and try to log back in?
Is there something wrong with my apache approach?  Are you able to log in if you enable that in Apache, log out and try to log back in?
Failing these, can anybody give me a hint as to where cookies are being set in expressionengine so I can dig in there and try to fix this?



Question: Conditional redirect based on referring source?
Answer: You can use RewriteCond %{REMOTE_HOST} or RewriteCond %{REMOTE_ADDR} to set such redirects.

Try something like:


#A.B.C.D is the referrer IP@
RewriteCond %{REMOTE_HOST} ^A\.B\.C\.D
RewriteRule ^(.*)$ http://www.yoursite.com/landingpage.html [NC,L,U,QSA]