Set HttpOnly flag also for session cookie

1 files changed, 1 insertions, 0 deletions

diff --git a/program/include/rcube.php b/program/include/rcube.php
index 3b1601578..a39eab15c 100644
--- a/program/include/rcube.php
+++ b/program/include/rcube.php
@@ -409,6 +409,7 @@ class rcube
         ini_set('session.use_cookies', 1);
         ini_set('session.use_only_cookies', 1);
         ini_set('session.serialize_handler', 'php');
+        ini_set('session.cookie_httponly', 1);
 
         // use database for storing session data
         $this->session = new rcube_session($this->get_dbh(), $this->config);