Change sercure when http or https is used
This commit is contained in:
@@ -40,11 +40,13 @@ function set_pppr_cookie($is_local, $street_name, $house_number, $postcode, $cit
|
||||
$signature = hash_hmac('sha256', $data_string, WP_PPPR_SALT);
|
||||
$cookie_value = $data_string . "|" . $signature;
|
||||
|
||||
$is_secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
|
||||
|
||||
setcookie("PPPR", $cookie_value, [
|
||||
'expires' => time() + 7200,
|
||||
'path' => '/',
|
||||
'domain' => $_SERVER['SERVER_NAME'],
|
||||
'secure' => true, // Only send over HTTPS
|
||||
'secure' => $is_secure, // Only send over HTTPS
|
||||
'httponly' => true, // Prevent JavaScript access
|
||||
'samesite' => 'Lax' // Protect against CSRF
|
||||
]);
|
||||
|
||||
Reference in New Issue
Block a user