Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4

Vulnerability

Description

In CodeIgniter 4 versions before 4.2.7, setting $secure or $httponly to true in Config\Cookie does not take effect when using set_cookie() or Response::setCookie() [3]. As a result, cookies intended to be transmitted only over HTTPS (Secure flag) or restricted from JavaScript access (HttpOnly flag) are erroneously exposed to scripts running in the browser. This occurs because the helper function and response method fail to propagate these configuration values, defaulting to insecure behavior [4].

Exploitation and

Attack Surface

An attacker who can inject or execute arbitrary JavaScript on an affected site (e.g., via a cross-site scripting vulnerability) can read these unprotected cookies. No special network position is required beyond that needed for an XSS attack, and the vulnerability is triggered simply by the application using the default cookie-setting functions without manually specifying the secure/httponly flags [1][3]. Since session cookies are not affected, the primary risk is to non-session cookies carrying sensitive data (e.g., authentication tokens, personalization preferences) [3].

Impact

By bypassing the Secure and HttpOnly attributes, an attacker can steal cookie values that were intended to be protected from disclosure. This could lead to account takeover if the cookie contains an authentication token, or leakage of other sensitive information stored in cookies [1].

Mitigation

The vulnerability is fixed in CodeIgniter 4.2.7 [3]. Upgrading to this version ensures that the $secure and $httponly configuration values are properly applied. For users unable to upgrade, workarounds involve manually constructing cookies by passing the secure/httponly options directly to set_cookie() or building Cookie objects with the desired flags [3][4].