Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision 		Previous revision
litespeed_wiki:config:header-edit-set-cookie [2020/09/03 20:35]
Jackson Zhang created 		litespeed_wiki:config:header-edit-set-cookie [2023/02/09 20:52] (current)
Lisa Clarke Fix redirect link
Line 1: Line 1:
-====== LiteSpeed Alternative to Apache Header Edit ====== +~~REDIRECT>​https://docs.litespeedtech.com/lsws/​configuration/#​forcesecurecookie~~
- +
-LiteSpeed doesn'​t support Apache'​s header ''​edit''​ directive, and so the following Apache directive won't work on LiteSpeed: +
-  Header always edit Set-Cookie (.*) "​$1;​HTTPOnly;​Secure;​SameSite=none"​ +
-   +
-===== ''​secure''​ ===== +
-This particular case, which involves patching Set-Cookie with a ''​secure''​ flag when served over HTTPS, is automatically handled by LiteSpeed Web Server as of v5.4.5, and so it is unnecessary to use a directive for that. +
- +
-===== ''​HTTPOnly''​ ===== +
-For ''​HTTPOnly''​ settings, you should be able to use ''​php.ini''​. For example: +
-<​code>​ +
-  session.cookie_httponly=On +
- </code> +
- +
-===== New directive ''​ForceSecureCookie''​ enforce "​secure"​ and "​SameSite"​ cookie attribute ​ ===== +
-Starting from 5.4.9 build 2, a new directive ''​ForceSecureCookie''​ has been introduced to enforce "​secure"​ and "​SameSite"​ cookie attributes. It can be set in the Apache config file at the server or virtual host level, or in .htaccess of the document root directory. +
- +
-''​ForceSecureCookie''​ can use value +
-  off, on|secure, lax|same_site_lax,​ strict|same_site_strict,​ same_site_none +
-   +
-''​same_site_xxxx''​ value can be combined with ''​secure''​. +
- +
-For example: +
-To enforce ''​secure''​ attribute only: +
-  ForceSecureCookie secure +
-   +
-To enforce "​secure;​ SameSite=none;"​ attribute:​ +
-  ForceSecureCookie secure same_site_none +
- +
-To enforce "​SameSite=strict"​ attribute only +
-  ForceSecureCookie strict +
-or +
-  ForceSecureCookie same_site_strict +
-   +
-When using the above directives, please make sure to enclose with  +
-  <​IfModule LiteSpeed>​ +
-  ... +
-  </IfModule>​+
  • Admin
  • Last modified: 2020/09/03 20:35
  • by Jackson Zhang