Manual:$wgCookieSecure
Cookies: $wgCookieSecure | |
---|---|
Whether cookies are secured. |
|
Introduced in version: | 1.6.0 (r12253) |
Removed in version: | Still in use |
Allowed values: | (boolean or special value 'detect' ) |
Default value: | (see below) |
Other settings: Alphabetical | By function |
Details
Whether cookies should only be sent over HTTPS (Secure
attribute of cookies, see section 4.1.2.5 in RFC 6265).
HTTPS-only sites should set this to true
, to avoid cookie theft.
If configured with the default value, 'detect'
, the runtime value is calculated by looking at the protocol that the request came in under.
Sites using reverse proxies, load balancing or some other method which converts HTTPS requests into HTTP ones need to set the X-Forwarded-Proto
header for detection to work correctly.
(See also $wgVaryOnXFP
.)
Default value
MediaWiki version: | ≥ 1.18 |
$wgCookieSecure = 'detect';
MediaWiki versions: | 1.6 – 1.17 |
$wgCookieSecure = ($wgProto == 'https');