How to prefix the cookie with __Host-?

ℹ️ Support
1

scan.nextcloud.com suggests:

The __Host prefix mitigates cookie injection vulnerabilities within potential third-party software sharing the same second level domain. It is an additional hardening on top of ‘normal’ same-site cookies.

where can I set the cookie prefix?

2

Please don’t just omit the support template, there’s a reason it’s there. Which NC version are you using? I assume this warning is already fixed in a later version …

1 Like
3

you could try this: How to edit config.php for Nextcloud snap even though you’re not using the snap… it should be similar

occ config:system:set session.cookie_secure --value="true"

4

Are you sure that’s working? That’s a PHP ini config, not a Nextcloud one?
But even then it’s not necessary, as we set it automatically server/lib/base.php at 988b9c479dc72d0b9add899d6f8eb66cbb3fbaa2 · nextcloud/server · GitHub. Only the status.php did not setup a session in non-recent versions.

1 Like