feature #15372 [FrameworkBundle] Change the default value of cookie_httponly (jderusse)

This PR was merged into the 2.8 branch.

Discussion
----------

[FrameworkBundle] Change the default value of cookie_httponly

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | yes
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #15303
| License       | MIT
| Doc PR        | symfony/symfony-docs#5561

Commits
-------

a7bef1e Change the default value of cookie_httponly to fix #15303

Author: fabpot

UPGRADE-2.8.md

@@ -8,32 +8,32 @@ Form
    option together with the `Valid` constraint instead. Contrary to
    "cascade_validation", "constraints" must be set on the respective child forms,
    not the parent form.
-   
+
    Before:
-   
+
    ```php
    $form = $this->createForm('form', $article, array('cascade_validation' => true))
        ->add('author', new AuthorType())
        ->getForm();
    ```
-   
+
    After:
-   
+
    ```php
    use Symfony\Component\Validator\Constraints\Valid;
-   
+
    $form = $this->createForm('form', $article)
        ->add('author', new AuthorType(), array(
            'constraints' => new Valid(),
        ))
        ->getForm();
    ```
-   
+
    Alternatively, you can set the `Valid` constraint in the model itself:
-   
+
    ```php
    use Symfony\Component\Validator\Constraints as Assert;
-   
+
    class Article
    {
        /**
@@ -197,3 +197,17 @@ to the toolbar templates:
     {% endset %}
 {% endblock %}
 ```
+
+FrameworkBundle
+---------------
+
+ * The default value of the parameter `session`.`cookie_httponly` is now `true`.
+   It prevents scripting languages, such as JavaScript to access the cookie,
+   which help to reduce identity theft through XSS attacks. If your
+   application needs to access the session cookie, override this parameter:
+
+   ```yaml
+   framework:
+       session:
+           cookie_httponly: false
+   ```

src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php

@@ -340,7 +340,7 @@ private function addSessionSection(ArrayNodeDefinition $rootNode)
                         ->scalarNode('cookie_path')->end()
                         ->scalarNode('cookie_domain')->end()
                         ->booleanNode('cookie_secure')->end()
-                        ->booleanNode('cookie_httponly')->end()
+                        ->booleanNode('cookie_httponly')->defaultTrue()->end()
                         ->scalarNode('gc_divisor')->end()
                         ->scalarNode('gc_probability')->defaultValue(1)->end()
                         ->scalarNode('gc_maxlifetime')->end()

src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/full.php

@@ -32,7 +32,7 @@
         'cookie_path' => '/',
         'cookie_domain' => 'example.com',
         'cookie_secure' => true,
-        'cookie_httponly' => true,
+        'cookie_httponly' => false,
         'gc_maxlifetime' => 90000,
         'gc_divisor' => 108,
         'gc_probability' => 1,

src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/full.xml

@@ -14,7 +14,7 @@
         <framework:esi enabled="true" />
         <framework:profiler only-exceptions="true" enabled="false" />
         <framework:router resource="%kernel.root_dir%/config/routing.xml" type="xml" />
-        <framework:session gc-maxlifetime="90000" gc-probability="1" gc-divisor="108" storage-id="session.storage.native" handler-id="session.handler.native_file" name="_SYMFONY" cookie-lifetime="86400" cookie-path="/" cookie-domain="example.com" cookie-secure="true" cookie-httponly="true" save-path="/path/to/sessions" />
+        <framework:session gc-maxlifetime="90000" gc-probability="1" gc-divisor="108" storage-id="session.storage.native" handler-id="session.handler.native_file" name="_SYMFONY" cookie-lifetime="86400" cookie-path="/" cookie-domain="example.com" cookie-secure="true" cookie-httponly="false" save-path="/path/to/sessions" />
         <framework:request>
             <framework:format name="csv">
                 <framework:mime-type>text/csv</framework:mime-type>

src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/full.yml

@@ -24,7 +24,7 @@ framework:
         cookie_path:      /
         cookie_domain:    example.com
         cookie_secure:    true
-        cookie_httponly:  true
+        cookie_httponly:  false
         gc_probability:  1
         gc_divisor:      108
         gc_maxlifetime:  90000

src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php

@@ -149,7 +149,7 @@ public function testSession()
         $this->assertEquals('/', $options['cookie_path']);
         $this->assertEquals('example.com', $options['cookie_domain']);
         $this->assertTrue($options['cookie_secure']);
-        $this->assertTrue($options['cookie_httponly']);
+        $this->assertFalse($options['cookie_httponly']);
         $this->assertEquals(108, $options['gc_divisor']);
         $this->assertEquals(1, $options['gc_probability']);
         $this->assertEquals(90000, $options['gc_maxlifetime']);