| 1 |
<?php |
| 2 |
if (!defined('ABSPATH')) { |
| 3 |
exit; |
| 4 |
} |
| 5 |
?> |
| 6 |
<tr> |
| 7 |
<th scope="row">Cookie security |
| 8 |
<p class="description"><?php esc_html_e('A secure cookie is only sent to the server with a encrypted request over the HTTPS protocol.', 'http-headers'); ?></p> |
| 9 |
<p class="description"><?php esc_html_e("To prevent cross-site scripting (XSS) attacks, HttpOnly cookies are inaccessible to JavaScript's Document.cookie API; they are only sent to the server.", 'http-headers'); ?></p> |
| 10 |
<p class="description"><?php esc_html_e('SameSite prevents the browser from sending this cookie along with cross-site requests. The main goal is mitigate the risk of cross-origin information leakage. It also provides some protection against cross-site request forgery attacks.', 'http-headers'); ?></p> |
| 11 |
<hr> |
| 12 |
<p class="description"><?php esc_html_e('Read more at', 'http-headers'); ?> |
| 13 |
<a target="_blank" href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#Secure_and_HttpOnly_cookies"><?php esc_html_e('MDN Web Docs', 'http-headers'); ?></a> |
| 14 |
</p> |
| 15 |
</th> |
| 16 |
<td> |
| 17 |
<fieldset> |
| 18 |
<legend class="screen-reader-text">Cookie security</legend> |
| 19 |
<?php |
| 20 |
$http_headers_cookie_security = get_option('hh_cookie_security', 0); |
| 21 |
foreach ($http_headers_bools as $http_headers_k => $http_headers_v) |
| 22 |
{ |
| 23 |
?><p><label><input type="radio" class="http-header" name="hh_cookie_security" value="<?php echo esc_attr($http_headers_k); ?>"<?php checked($http_headers_cookie_security, $http_headers_k); ?> /> <?php echo esc_html($http_headers_v); ?></label></p><?php |
| 24 |
} |
| 25 |
?> |
| 26 |
</fieldset> |
| 27 |
</td> |
| 28 |
<td> |
| 29 |
<?php settings_fields( 'http-headers-cose' ); ?> |
| 30 |
<?php do_settings_sections( 'http-headers-cose' ); ?> |
| 31 |
<?php |
| 32 |
$http_headers_items = array('Secure', 'HttpOnly', 'SameSite'); |
| 33 |
$http_headers_cookie_security_value = get_option('hh_cookie_security_value'); |
| 34 |
foreach ($http_headers_items as $http_headers_item) |
| 35 |
{ |
| 36 |
$http_headers_is_checked = is_array($http_headers_cookie_security_value) && array_key_exists($http_headers_item, $http_headers_cookie_security_value); |
| 37 |
?> |
| 38 |
<p> |
| 39 |
<label><input type="checkbox" |
| 40 |
class="http-header-value" |
| 41 |
name="hh_cookie_security_value[<?php echo esc_attr($http_headers_item); ?>]" |
| 42 |
value="1"<?php echo !$http_headers_is_checked ? NULL : ' checked'; ?><?php echo $http_headers_cookie_security == 1 ? NULL : ' readonly'; ?>> <?php echo esc_html($http_headers_item); ?><?php |
| 43 |
?></label> |
| 44 |
</p> |
| 45 |
<?php |
| 46 |
if ($http_headers_item == 'SameSite') |
| 47 |
{ |
| 48 |
foreach (array('None', 'Lax', 'Strict') as $http_headers_s_val) |
| 49 |
{ |
| 50 |
?> |
| 51 |
<p class="hh-csv-value<?php echo !$http_headers_is_checked ? ' hh-hidden' : NULL; ?>"> |
| 52 |
<label><input type="radio" |
| 53 |
class="http-header-value" |
| 54 |
name="hh_cookie_security_value[SameSite]" |
| 55 |
value="<?php echo esc_attr($http_headers_s_val); ?>"<?php echo !is_array($http_headers_cookie_security_value) || !array_key_exists($http_headers_item, $http_headers_cookie_security_value) || $http_headers_cookie_security_value[$http_headers_item] != $http_headers_s_val ? NULL : ' checked'; ?><?php echo $http_headers_cookie_security == 1 ? NULL : ' readonly'; ?>> <?php echo esc_html($http_headers_s_val); ?></label> |
| 56 |
</p> |
| 57 |
<?php |
| 58 |
} |
| 59 |
} |
| 60 |
} |
| 61 |
?> |
| 62 |
</td> |
| 63 |
</tr> |
