Skip to content Skip to sidebar

Home › Support › English Support › [Resolved] WPML HttpOnly flag security issues.

[Resolved] WPML HttpOnly flag security issues.

This thread is resolved. Here is a description of the problem and solution.

Problem:
The client is concerned about the security of the WPML plugin because the HttpOnly flag is missing in the cookie definition for 'wp-wpml_current_language'. This issue has been raised due to security report requirements, despite the cookie not containing sensitive information.
Solution:
We have investigated the behavior of the 'wp-wpml_current_language' cookie and found that:

  • For logged-in users, the cookie is set via PHP and can support the HttpOnly flag.
  • For non-logged-in users, the cookie is set via JavaScript to ensure correct language settings on cached websites, making the HttpOnly flag inapplicable as it would prevent JavaScript access and disrupt functionality.

Security measures currently in place include:

  • SameSite=Lax to protect against CSRF attacks.
  • The cookie has a short lifespan of 1 day.
  • It only stores the language code, containing no personal or sensitive information.

This design is necessary to balance functionality and security, especially for non-logged-in users on cached websites.

If this solution does not resolve your issue or seems outdated, we recommend checking related known issues at https://wpml.org/known-issues/, verifying the version of the permanent fix, and confirming that you have installed the latest versions of themes and plugins. If further assistance is needed, please feel free to open a new support ticket at WPML support forum.

This is the technical support forum for WPML - the multilingual WordPress plugin.

Everyone can read, but only WPML clients can post here. WPML team is replying on the forum 6 days per week, 22 hours per day.

Tagged: 

This topic contains 1 replies, has 0 voices.

Last updated by Shekhar Bhandari 12 months ago.

Assisted by: Shekhar Bhandari.

Author Posts
May 5, 2025 at 7:26 am #16994756

Gil

Background of the issue:
I am trying to address a security issue with the WPML plugin where the HttpOnly flag is missing in the cookie definition. This is the third ticket I've opened about this issue, and the previous response was not sufficient. Although there is no sensitive information in the WPML cookie, I need to make it safe for a report.

Symptoms:
The HttpOnly flag is missing in the cookie wp-wpml_current_language.

Questions:
How can I fix the cookie to include the HttpOnly flag?
May 15, 2025 at 8:03 am #17035454

Shekhar Bhandari
WPML Supporter since 03/2015

Languages: English (English )

Timezone: Asia/Kathmandu (GMT+05:45)

Hello,

Our development team has reviewed the behavior of the wp-wpml_current_language cookie and provided the following clarification.

This cookie is used by WPML to store a user’s language preference across different pages. WPML sets this cookie in two different ways:

  • For logged-in users – The cookie is set via PHP. In this case, it can support the HTTPOnly flag because JavaScript access isn't needed.
  • For non-logged-in users – The cookie is set via JavaScript. This is necessary because:
    • On most cached websites (using caching plugins, CDNs, etc.), PHP does not run for every request. Instead, a single cached version of the page is served to all users.
    • To maintain the correct language for each visitor despite caching, JavaScript must set the cookie after the page loads in the browser.

Since HTTPOnly cookies cannot be accessed by JavaScript (by design), applying this flag would prevent the JavaScript-based method from working and break language persistence for non-logged-in users.

Security Considerations applied at the moment:

  • SameSite=Lax: Helps protect against CSRF attacks.
  • Short lifespan: The cookie expires in 1 day, limiting potential misuse.
  • Minimal data: It only stores the language code (e.g., en) and contains no personal or sensitive information.

Conclusion:
The current implementation is a necessary and deliberate design choice to ensure proper functionality for all users, particularly on cached websites. While the HTTPOnly flag enhances security, it is not compatible with the required client-side behavior for non-logged-in users. WPML compensates with other protective measures, ensuring a balanced approach between functionality and security.

Please feel free to reach out if you have any further questions.

Best regards