Problem: The client is concerned about the security of the WPML plugin because the HttpOnly flag is missing in the cookie definition for 'wp-wpml_current_language'. This issue has been raised due to security report requirements, despite the cookie not containing sensitive information. Solution: We have investigated the behavior of the 'wp-wpml_current_language' cookie and found that:
For logged-in users, the cookie is set via PHP and can support the HttpOnly flag.
For non-logged-in users, the cookie is set via JavaScript to ensure correct language settings on cached websites, making the HttpOnly flag inapplicable as it would prevent JavaScript access and disrupt functionality.
Security measures currently in place include:
SameSite=Lax to protect against CSRF attacks.
The cookie has a short lifespan of 1 day.
It only stores the language code, containing no personal or sensitive information.
This design is necessary to balance functionality and security, especially for non-logged-in users on cached websites.
If this solution does not resolve your issue or seems outdated, we recommend checking related known issues at https://wpml.org/known-issues/, verifying the version of the permanent fix, and confirming that you have installed the latest versions of themes and plugins. If further assistance is needed, please feel free to open a new support ticket at WPML support forum.
Problem: The client is concerned about security issues identified in a security report, specifically that the HttpOnly flag is missing in the cookie definition, and a session cookie is not marked as secure, even though it is transmitted over HTTPS. Solution: We recommend setting the HttpOnly flag on cookies that contain sensitive information, such as session identifiers or user credentials, to mitigate the risk of Cross-Site Scripting (XSS) attacks. However, it's important to note that WPML cookies do not store any sensitive information; they only store the language code. Since a language code is not a session identifier, it does not pose the same security risks. For more details, you can visit our documentation on browser cookies stored by WPML at https://wpml.org/documentation/support/browser-cookies-stored-wpml/.
If this solution does not apply to your case, or if it seems outdated, we highly recommend checking related known issues at https://wpml.org/known-issues/, verifying the version of the permanent fix, and confirming that you have installed the latest versions of themes and plugins. If further assistance is needed, please open a new support ticket at our support forum.
